It is when your DNS queries travel outside the tunnel you believe carries them. Your VPN hides the page contents and the destination address, but if the lookups still go to your ISP resolver, your ISP holds a timestamped list of every domain you visited. That list is close to a browsing history.

Why does the test show more resolver addresses than I configured?

Large resolvers separate the address you send queries to from the addresses they send queries out from. Cloudflare, Google, and Quad9 all fan out across pools. Six tokens can surface eight or more egress addresses from one operator. Judge the result by the owner, not the count.

I use DNS over HTTPS. Will this test still work?

Yes, and the resolver shown will be your DoH provider. DoH encrypts the hop from your device to the resolver; the resolver still performs ordinary DNS to reach our authoritative server, and that is the hop we observe. So DoH changes who sees your queries, not whether this test can identify them.

My VPN is on and the resolvers belong to a public service like Cloudflare. Is that a leak?

It is not a leak to your ISP, which is the risk this test targets. It does mean a third party sees your query stream tied to the VPN exit address rather than to you. Whether that matters depends on your threat model, and the verdict says which case you are in rather than guessing.

How long do you keep the resolver addresses?

For the life of the session, which is ten minutes, after which the token and its records expire. Tokens are 128 bits of randomness, so a session cannot be guessed or enumerated. Nothing is written to a permanent store.

DNS Leak Test

Find out which DNS resolvers really answer for you, who owns them, and whether they belong to your VPN or to your ISP.

DNS leak test

Asking six single-use names…

Your device is resolving six names that have never existed before. We run the authoritative server for them.

Waiting for the first resolver…

This connection: 216.73.216.7
Egress network: AS16509 Anthropic, PBC
Probe zone: *.leak.whatsmyip.fyi

This test needs JavaScript. The page has to make your device resolve six single-use names, and only your browser can do that. Nothing about your connection is wrong.

How the test works

The page generates a session identifier and six random tokens, then requests a small resource at <token>.leak.whatsmyip.fyi for each. We run the authoritative nameserver for that zone, so the query cannot be answered from any cache; every token is new and has never been resolved before. When a resolver asks us for a token, we record its source address against the session. The page polls /api/v1/dnsleak/{session} until the results settle.

Six tokens rather than one, because resolver pools distribute queries. A single token surfaces one egress address and can miss a second resolver entirely.

Reading a mixed result

The most common confusing outcome is a mix: several addresses from a VPN provider and one from an ISP. That is still a leak. It usually means one of two things.

A hard-coded resolver somewhere in the path. Some routers, some smart TVs, and some operating system network profiles pin a resolver address that the VPN client does not override.
IPv6 taking a different path. A VPN that tunnels only IPv4 leaves IPv6 DNS on the ISP resolver. The fix is at the VPN, not at the browser.

Fixing a leak

Turn on the VPN client’s own DNS handling rather than leaving system DNS in place, and enable the kill switch or firewall lockdown so nothing reaches the network outside the tunnel. On Windows, also disable smart multi-homed name resolution, which sends queries out of every interface in parallel by design. If your browser has its own secure DNS setting enabled, it will bypass both the system and the VPN resolver, so set it to off or to the VPN provider explicitly.

Limits

We see the last hop only. A resolver that forwards to another resolver appears to us as the forwarder, so a corporate or router-level resolver can hide what sits behind it. The test also proves nothing about queries your device made before you opened this page.

About this tool

This test makes your browser request six single-use random hostnames in a zone we run the authoritative server for, so that server records exactly which resolvers asked for each token. We then look up the owner, ASN, and country of every resolver that appeared, and compare them with the network your traffic egresses from. Tokens expire after ten minutes.

How to read the result

Verdict: No leak (resolvers belong to your VPN): Every resolver that queried our authoritative server belongs to the VPN provider your traffic egresses through, by autonomous system or declared resolver range. No ISP resolver appeared, so your lookups are going through the VPN.
Verdict: Leak: ISP resolvers seen while on VPN: At least one resolver that queried us belongs to the same autonomous system as your ISP, while your HTTP traffic egresses through a VPN or hosting ASN. The VPN still hides the page contents, but your ISP sees which domains you look up.
Verdict: Standard (no VPN detected): Your HTTP egress ASN is a residential or mobile network, and the resolvers match either that ISP or a public resolver you configured. There is no tunnel to leak out of, so this verdict describes your setup rather than passing or failing it.
Resolver IP, owner, ASN, country: The source address of every query our authoritative server received, resolved to the announcing ASN and the organisation behind it. Large public resolvers use anycast, so the country shown is where the nearest instance sits, not where the organisation is.
Number of resolvers seen: Resolver farms fan queries out across a pool of egress addresses, so six tokens can surface a dozen source addresses from one provider. Many addresses from one owner is expected, and addresses from two different owners is the interesting case.
DoH or DoT hint: A guess at whether your device reached its resolver over an encrypted transport, shown when the resolver address falls in a range the provider publishes as a DoH or DoT endpoint. It comes from the address rather than from a measurement, because our authoritative server sees only the last hop, which is always plain DNS on port 53.

Questions people ask

What is a DNS leak?: It is when your DNS queries travel outside the tunnel you believe carries them. Your VPN hides the page contents and the destination address, but if the lookups still go to your ISP resolver, your ISP holds a timestamped list of every domain you visited. That list is close to a browsing history.
Why does the test show more resolver addresses than I configured?: Large resolvers separate the address you send queries to from the addresses they send queries out from. Cloudflare, Google, and Quad9 all fan out across pools. Six tokens can surface eight or more egress addresses from one operator. Judge the result by the owner, not the count.
I use DNS over HTTPS. Will this test still work?: Yes, and the resolver shown will be your DoH provider. DoH encrypts the hop from your device to the resolver; the resolver still performs ordinary DNS to reach our authoritative server, and that is the hop we observe. So DoH changes who sees your queries, not whether this test can identify them.
My VPN is on and the resolvers belong to a public service like Cloudflare. Is that a leak?: It is not a leak to your ISP, which is the risk this test targets. It does mean a third party sees your query stream tied to the VPN exit address rather than to you. Whether that matters depends on your threat model, and the verdict says which case you are in rather than guessing.
How long do you keep the resolver addresses?: For the life of the session, which is ten minutes, after which the token and its records expire. Tokens are 128 bits of randomness, so a session cannot be guessed or enumerated. Nothing is written to a permanent store.

Last reviewed 2026-09-05.