Zunavek

DNS Leak Test

This test triggers lookups for unique subdomains from your browser and shows the DNS infrastructure visible to our authoritative server. If you use a VPN, compare the observed providers with the DNS service you expect.

What Is a DNS Leak?

A DNS leak happens when domain lookups use a different route or resolver from the VPN path you intended. The DNS service handling them can learn many of the domain names your device looks up, but DNS does not include the full URL or page path, and a lookup does not always mean you visited that site. DNS-over-HTTPS or DNS-over-TLS can encrypt the connection to a resolver, but that resolver may still sit outside your intended VPN path.

How Does This DNS Leak Test Work?

When you start the test, we create several one-time hostnames, such as a1b2c3d4-3.leak.zunavek.com. Your browser makes a harmless request to each one, for example https://a1b2c3d4-3.leak.zunavek.com/dns-probe. Because every hostname is unique, your recursive DNS service normally cannot answer from an old cache entry and must obtain an answer from our authoritative DNS server.

Our server records the source IP of the DNS infrastructure that asks for those names, identifies the provider behind it, and returns the list to your browser. A configured resolver can forward a query through another resolver or an egress node, so the address shown here is what our server can see. It is not guaranteed to be the exact DNS server configured on your device.

This page checks the normal DNS path. Our IPv6 Leak Test compares paired names such as v4-a1b2c3d4-1.leak.zunavek.com and v6-a1b2c3d4-1.leak.zunavek.com. The first is IPv4 A-only and the second IPv6 AAAA-only. These DNS test groups do not establish the route of IPv4 or IPv6 traffic. An unexpected provider is a reason to review your setup; identifying VPN bypass requires additional routing context.

Why DNS Leaks Are Dangerous

  • An unexpected resolver can receive many of the domain names your device looks up.
  • DNS outside the intended VPN path can bypass the privacy or filtering policy you selected.
  • Classic unencrypted DNS can be observed or altered by networks between your device and the resolver.
  • DNS metadata can reveal browsing patterns even though it does not include full URLs or page content.

How to Fix DNS Leaks

  • Enable DNS leak protection and the kill switch in your VPN client.
  • Use your VPN provider’s DNS service and make sure DNS is routed through the tunnel.
  • Check whether browser or operating-system secure DNS settings override the VPN’s DNS choice.
  • DNS-over-HTTPS and DNS-over-TLS encrypt traffic to the selected resolver, but they do not by themselves prove that DNS follows the VPN path. Choose a resolver compatible with your VPN setup and test again.
  • Check your VPN's documented IPv6 routing or blocking settings. Our IPv6 Leak Test observes browser requests and DNS test groups; it cannot certify IPv6 tunnel protection.

For a step-by-step walkthrough, read our full guide: How to Prevent DNS Leaks.

Related Tools & Guides

  • IPv6 Leak Test - compare IPv6 request and DNS test-group observations.
  • WebRTC Leak Test - inspect WebRTC addresses and compare them with your HTTP connection.
  • Forward DNS Lookup - resolve any domain to its A, AAAA, MX, and other DNS records.
  • IP Lookup - find geolocation, ASN, and risk data for any IP address.

Frequently Asked Questions

Can my ISP still see my traffic if I use DNS-over-HTTPS?

DNS-over-HTTPS (DoH) encrypts queries between your client and the selected resolver, limiting what a network observer can read on that connection. The resolver still receives those queries; if it is your ISP, DoH does not hide them from that provider. DoH also does not hide destination IP addresses or by itself route traffic through a VPN.

Why does this test show a network ASN match while my VPN is on?

The match compares an observed DNS address with your current public IP's ASN, which may already belong to your VPN provider. It does not identify your pre-VPN ISP. If a resolver differs from what you intended, review split tunneling, browser secure DNS, fallback behavior, and the VPN's documented DNS and IPv6 settings before drawing a conclusion.

How often should I run a DNS leak test?

Run a test every time you connect to a new network, switch VPN servers, or update your VPN client. Network configuration changes can silently reintroduce DNS leaks even if your setup was previously secure.