PRIVACY & SECURITY

DNS Leak Test: How to Verify Your VPN Isn’t Leaking

You've connected your VPN, but is it actually doing its job? Knowing how to test DNS leak VPN setups is a core skill for anyone relying on a VPN for…

✓What a DNS Leak Is in 60 Seconds✓Running the Test Correctly: Before✓Interpreting Results and Fixing

Quick Answer

A DNS leak test forces your device to resolve unique hostnames and reports which servers answered; run it with the VPN off for a baseline, then on. If any baseline resolver appears while connected, you have a leak; an IP check alone is not enough, a routine HomeIPVPN verifies on every client setup before handover.

The sequence: Baseline with the VPN off, note the local resolvers as your leak signature, then run the same test with the VPN on.
Fixes in order: Enable the app’s use-VPN-DNS option, disable DNS passthrough on the travel router, and turn the kill switch on.
Re-test over time: Test right after connecting and again after ten minutes; DHCP renewals can introduce leaks that were not there at first.

DNS Leak Test: How to Verify Your VPN Isn't Leaking

You've connected your VPN, but is it actually doing its job? Knowing how to test DNS leak VPN setups is a core skill for anyone relying on a VPN for location consistency, whether you're a remote worker on a home IP VPN or just protecting yourself on hotel Wi-Fi. This guide explains what DNS leaks are, how to run the test correctly, and what to do with the results.

What a DNS Leak Is in 60 Seconds

Every time you visit a website, your device asks a DNS server to translate the domain name into an IP address. When your VPN is working properly, those DNS queries travel inside the encrypted tunnel and are answered by a resolver on the VPN side (your home network, or the VPN provider's DNS).

A DNS leak happens when some or all of those queries escape the tunnel and go to your local network's DNS instead, your hotel's resolver, the airport's, your mobile carrier's. The consequences:

Your location leaks. DNS resolvers are geolocated. Queries hitting a Bangkok hotel's DNS while your IP claims to be in Chicago is a dead giveaway.
Your browsing leaks. The local network operator sees every domain you look up, even though your traffic content is encrypted.
It's silent. Nothing looks wrong, websites load, your IP check passes. Only the test reveals it.

This is why IP checks alone are insufficient. An IP check tells you where your traffic exits; a DNS leak test tells you where your queries go. You need both to agree.

Running the Test Correctly: Before and After VPN

The test is only meaningful as a comparison. Follow this exact sequence:

Step 1, Baseline: VPN disconnected

Connect to the local network directly (hotel Wi-Fi, mobile data, however you'd connect without the VPN).
Open a DNS leak test site (several free ones exist, search "DNS leak test").
Run the standard test and note the results: which DNS servers responded, which ISP/country they belong to.
Take a screenshot or write down the server list. This is your "leak signature", what failure looks like.

Step 2, VPN connected

Connect your VPN (or connect through your travel router with the tunnel up).
Run the same test on the same site.
Compare carefully against the baseline.

Step 3, Interpret

Result	Meaning
Only VPN-side resolvers, matching your home/provider location	Pass, no leak
Baseline (local) resolvers appear, alone or mixed with VPN ones	Fail, DNS is leaking
A resolver you don't recognize, geolocated oddly	Investigate, could be a fallback or a browser DoH resolver bypassing the tunnel
No results / test fails to load	Test site blocked or DNS fully broken, fix connectivity first

Run the extended test too. Most leak-test sites offer a standard and an extended test. The extended version makes more queries and catches intermittent leaks (e.g., a secondary resolver that only answers occasionally). If the standard test passes but you're thorough, run the extended one.

Wait and re-test. Run the test once immediately after connecting and again after 10+ minutes. DHCP renewals, network changes, and fallback logic can introduce leaks that don't exist at first connect.

Interpreting Results and Fixing Leaks

Found a leak? Work through the fixes in order:

VPN app settings: Enable the app's own DNS leak protection / "use VPN DNS" option. Most reputable apps have one, make sure it's on.
Router DNS settings: On a travel router, disable DNS passthrough from the upstream network and set custom DNS to resolve through the tunnel (your home router's tunnel IP, or a chosen public resolver reached via the tunnel).
Kill switch on: Enable "block non-VPN traffic" so DNS can't escape during tunnel drops or reconnects.
Device-level bypasses: Disable Android Private DNS, browser DNS-over-HTTPS (or point it through the tunnel), and iCloud Private Relay while testing, each can route queries outside the tunnel independently.
IPv6: If your VPN handles only IPv4, IPv6 DNS queries may leak around it. Either enable IPv6 in the tunnel or disable IPv6 on the device/router.
Flush caches and re-test: DNS results cache aggressively. Reconnect the network or reboot the router before re-testing, or you'll chase a ghost.

After each fix, re-run the full before/after test. Change one thing at a time so you know what actually fixed it.

Making Leak Tests a Habit

New network? Quick test. Every hotel, Airbnb, and coworking network is a new opportunity for something to behave differently.
Settings changed? Re-test. Especially after firmware updates, which love to reset DNS options.
Monthly spot-check. Thirty seconds, even when everything seems fine.
Know your "good" result. Memorize which resolvers and country a passing test shows for your setup, then any deviation jumps out immediately.

Frequently Asked Questions

What's the difference between a DNS leak and an IP leak? +

An IP leak exposes your real IP address (the tunnel failed or bypassed). A DNS leak keeps your IP hidden but exposes your DNS queries to local resolvers, revealing your location and browsing. Both matter; test for both.

Do I need to test if my VPN app claims leak protection? +

Yes. Claims are marketing; the test is evidence. It takes a minute and occasionally surprises even users of good VPN software, especially after updates.

Can WebRTC cause something that looks like a DNS leak? +

They're separate issues with similar consequences. WebRTC can expose your real local IP addresses via the browser; DNS leaks expose your queries via resolvers. Test for both, a DNS test won't catch a WebRTC leak and vice versa.

Why do I see my VPN provider's DNS and is that okay? +

Yes, that's the expected passing result for a commercial VPN, queries resolved by the provider's DNS through the tunnel. For a home IP VPN, you'd expect your home network's DNS instead. Either is fine as long as it's tunnel-side and location-consistent.

Does DNS-over-HTTPS prevent DNS leaks? +

DoH encrypts queries but doesn't control where they go. If your browser sends DoH queries to a resolver outside the tunnel, that's still a location signal, encryption isn't the same as correct routing.

Are free DNS leak test sites trustworthy? +

The well-known ones are widely used and safe for this purpose, they only see the DNS queries your device makes to their test domains, which is exactly what you're trying to measure. No personal data is involved.

Need help setting this up?

Tested and still not sure what you're looking at? Send your setup our way. Our VPN audit verifies it properly and fixes what's broken: https://homeipvpn.com.

DNS Leak Test: How to Verify Your VPN Isn’t Leaking