What is a DNS leak?

Something looks up every site you visit before you get there. A DNS leak means those lookups are going somewhere you never chose. Left alone, that somewhere is your internet provider.

What’s actually happening

Before your browser can load a site, it has to look up the address. Every site, every app, every background update. Whoever answers those lookups ends up holding a list of everywhere you go, timestamped.

What a leak is

A leak is a query going somewhere other than where you pointed it. The clearest case is a VPN: connect one and those lookups are supposed to travel inside the tunnel with everything else. A DNS leak means they go around it. Your traffic stays encrypted, but your ISP still sees every domain you asked for.

The VPN looks like it’s working. Nothing tells you otherwise.

You don’t need a VPN to leak

A VPN is the most common reason people come looking, not a requirement for having a problem. Point your router at Quad9, run a Pi-hole, switch on encrypted DNS on your phone. You configured something, and the only question is whether it’s being honoured. Often it isn’t.

Your provider intercepts port 53. Some quietly redirect every DNS query on their network to their own servers, whatever you set. The answers come back looking normal. This is the commonest leak that has nothing to do with a VPN, and nothing on your device will tell you it’s happening.
A device ignores you. Chromecasts and a lot of smart-home hardware have 8.8.8.8 built in and never read your router’s settings.
The network overrides the machine. Set DNS on the laptop and the next DHCP lease can hand it something else.
Your browser goes around your network. Firefox and Chrome ship their own DNS over HTTPS, which walks straight past the Pi-hole the rest of the house is behind.
Your phone is on two networks at once. Wi-Fi and cellular each carry DNS settings, and whichever answers first wins.

HTTPS doesn’t cover this

HTTPS hides what you do on a site. It doesn’t hide which site you went to. The domain is visible during the handshake, and the lookup that came before it was in the clear.

So a leak still gives up a decent picture of you: your bank, whatever you research at 2am, your employer’s intranet, which apps are on your phone. Some countries require that list be retained. Some providers sell it.

When it isn’t a leak

If you set up encrypted DNS yourself, with Quad9, NextDNS, Cloudflare or your country’s public resolver, that’s the name you’ll see, and it’s fine. You picked it, your ISP can’t read the queries, and a resolver in another country is a choice rather than a fault.

Which is exactly why we name the operator instead of grading it. We can see who answered; we can’t see what you configured, and no test run from our end can. You close that gap in about a second by recognising the name or failing to. The reverse holds too: seeing your own provider answer is only good news if your provider is who you asked for.

How we can tell

Your own machine can’t answer this. It knows which resolver it’s configured to use, not which one actually replied. That’s only visible from the other end, which is where we sit. We hand your browser a few hostnames nobody has ever looked up, then watch which resolver turns up to ask about them.

Two more places you can leak

VPNs that only cover IPv4 let IPv6 traffic out of the tunnel, and WebRTC can hand your address straight to a web page without involving DNS at all. The test checks both.

Found a leak?

Here’s how to fix it, starting with why changing DNS provider won’t do it.