DNS leak test
Who actually answers your DNS?
Every site you visit starts with a DNS lookup, and it can go somewhere you never chose. We watch from the other end and name whoever answered.
Your connection
216.73.216.42
Columbus, United States · Amazon.com, Inc.
572,465 tests run so far
Your connection216.73.216.42Columbus, United States · Amazon.com, Inc.
What it checks
Who answered
The resolvers that handled your lookups, with city and network. Providers like Quad9 and NextDNS are named.
Leaks that come and go
Lookups go out over several seconds. Run deeper sends up to 90 to catch a leak that shows up now and then.
IPv6
Half the lookups ask for IPv6 addresses, and the result says whether your resolver reached us over IPv6.
WebRTC
Whether your browser exposes an address other than your connection’s.
DNSSEC
Whether your resolver asks for DNSSEC records. That shows it’s aware of DNSSEC, not that it checks signatures.
Time zone
Whether your device’s time zone matches where your IP address puts you.
- No trackers
- No analytics
- No cookies
- No accounts
- Nothing loaded from anyone else
Run it from a script
Free, with no key or account. Your code resolves a few hostnames and reads back who answered.
GET /api/new
A test ID and the hostnames to resolve.
GET /api/result/<id>
Who answered, and the verdict. Kept for ten minutes.
Text or JSON
curl and wget get readable text. Ask for JSON and you get JSON.
/llms.txt
The whole contract in one file, written for agents.
Common questions
What is a DNS leak?
A DNS leak is when your lookups go to a resolver you didn’t choose, often your internet provider’s. It happens around a VPN, and without one when your provider, router or a device overrides the DNS you set.
How does the test know who answered?
Your browser looks up a few hostnames nobody has used before. Your resolver has to ask our nameserver about them, so we see which resolver asked and name it.
Do I need a VPN to have a DNS leak?
No. Internet providers that intercept DNS, devices with DNS built in, router overrides and browsers with their own DNS over HTTPS can all send lookups somewhere you didn’t choose.
Why doesn’t every result say leak or no leak?
We can’t see what you configured. A resolver in another country could be one you chose or one you didn’t, so we name it and let you decide. A partial leak, where some lookups went somewhere the rest didn’t, is flagged either way.
Will changing my DNS provider fix a leak?
No. It changes who receives the leaked lookups. The fix belongs wherever they’re diverted: your VPN app, operating system, router, or a device that ignores them. The guide to fixing a DNS leak covers each.
What does DNS Leak keep about me?
Test results stay in memory for ten minutes, then they’re discarded. After that only a daily count of tests remains, with no addresses. No cookies, accounts or analytics, and the page loads nothing from anyone else. The privacy page has the details.
Is there an API?
Yes. It’s free, needs no key or account, and returns text to curl and JSON to scripts. The API docs cover every field.
What does Run deeper do?
It runs a longer test of up to 90 lookups, to catch a leak that only happens now and then. More lookups to the same nameserver, not more locations.