ZunavekZunavek
Full ScanIP Lookup

DNS Leak Test

This test triggers lookups for unique subdomains from your browser and shows the DNS infrastructure visible to our authoritative server. If you use a VPN, compare the observed providers with the DNS service you expect.

What Is a DNS Leak?

A DNS leak happens when domain lookups use a different route or resolver from the VPN path you intended. The DNS service handling them can learn many of the domain names your device looks up, but DNS does not include the full URL or page path, and a lookup does not always mean you visited that site. DNS-over-HTTPS or DNS-over-TLS can encrypt the connection to a resolver, but that resolver may still sit outside your intended VPN path.

How Does This DNS Leak Test Work?

When you start the test, we create several one-time hostnames, such as a1b2c3d4-3.leak.zunavek.com. Your browser makes a harmless request to each one, for example https://a1b2c3d4-3.leak.zunavek.com/dns-probe. Because every hostname is unique, your recursive DNS service normally cannot answer from an old cache entry and must obtain an answer from our authoritative DNS server.

Our server records the source IP of the DNS infrastructure that asks for those names, identifies the provider behind it, and returns the list to your browser. A configured resolver can forward a query through another resolver or an egress node, so the address shown here is what our server can see. It is not guaranteed to be the exact DNS server configured on your device.

This page checks the normal DNS path. Our IPv6 Leak Test compares paired names such as v4-a1b2c3d4-1.leak.zunavek.com and v6-a1b2c3d4-1.leak.zunavek.com. The first is IPv4 A-only and the second IPv6 AAAA-only. If a VPN is active and either test shows an ISP or another provider you did not expect, that may indicate a leak. Without a VPN, seeing DNS infrastructure from your ISP is usually normal.

Why DNS Leaks Are Dangerous

  • An unexpected resolver can receive many of the domain names your device looks up.
  • DNS outside the intended VPN path can bypass the privacy or filtering policy you selected.
  • Classic unencrypted DNS can be observed or altered by networks between your device and the resolver.
  • DNS metadata can reveal browsing patterns even though it does not include full URLs or page content.

How to Fix DNS Leaks

  • Enable DNS leak protection and the kill switch in your VPN client.
  • Use your VPN provider’s DNS service and make sure DNS is routed through the tunnel.
  • Check whether browser or operating-system secure DNS settings override the VPN’s DNS choice.
  • DNS-over-HTTPS and DNS-over-TLS encrypt traffic to the selected resolver, but they do not by themselves prove that DNS follows the VPN path. Choose a resolver compatible with your VPN setup and test again.
  • Use a VPN that tunnels IPv6, or disable IPv6 only if your VPN cannot protect it (check with our IPv6 Leak Test).

For a step-by-step walkthrough, read our full guide: How to Prevent DNS Leaks.

Related Tools & Guides

Frequently Asked Questions

Can my ISP still see my traffic if I use DNS-over-HTTPS?

DNS-over-HTTPS (DoH) encrypts your DNS queries so your ISP cannot read them. However, your ISP can still see the IP addresses you connect to unless you also use a VPN. DoH protects DNS specifically - it does not replace a full VPN tunnel.

Why does this test show my ISP’s DNS even though my VPN is on?

Common causes include split-tunneling settings that route DNS outside the tunnel, IPv6 leaks on dual-stack networks, or your operating system falling back to its default DNS resolver. Check your VPN’s DNS leak protection toggle and disable IPv6 if your VPN does not support it.

How often should I run a DNS leak test?

Run a test every time you connect to a new network, switch VPN servers, or update your VPN client. Network configuration changes can silently reintroduce DNS leaks even if your setup was previously secure.