DNS Leak Test
Generate unique, non-cacheable hostnames and use IPCheak's authoritative DNS observations to identify the recursive resolver exits that actually handled the requests.
What is a DNS leak?
DNS translates domain names into the IPv4 or IPv6 addresses needed to make a network connection. A browser usually performs this lookup before connecting to a site.
When you use a VPN or proxy, DNS requests should normally follow the DNS policy configured by that service. If requests still leave through your local network, ISP resolver, or another unexpected path, they may reveal the domains you intend to visit. This is commonly called a DNS leak.
Why DNS leaks happen
- The proxy handles HTTP, HTTPS, or TCP traffic but not system DNS, secure DNS in the browser, UDP, or IPv6.
- A rule engine resolves a domain locally before matching IP-based rules, including during a fallback path.
- The browser, operating system, router, and proxy use conflicting DNS settings, allowing some lookups to bypass the intended route.
- A VPN disconnect, split-tunnel rule, or incomplete dual-stack setup causes some requests to fall back to the ISP resolver.
What is Fake-IP mode?
Fake-IP mode first returns a placeholder address to the local device, commonly from the 198.18.0.0/15 benchmarking range. The device connects to that placeholder while the proxy core maps it back to the domain and performs the real lookup remotely. When configured correctly, this can reduce premature local DNS requests made for routing decisions.
How to interpret the results
The addresses in the table are the recursive-resolver exits that queried IPCheak's authoritative DNS server. They may not match the DNS address configured on your router. Public DNS services, ISP resolvers, DNS over HTTPS, proxy software, and browser secure DNS can all use multiple exit nodes.
A DNS exit that differs from your HTTP exit does not automatically mean there is a leak. Public resolvers may contact authoritative DNS servers from another city or network node. Consider the resolver operator, approximate location, your VPN's DNS policy, and whether an unexpected local ISP resolver appears. Test sessions and resolver observations are kept in memory briefly and are not added to permanent reports.
How to reduce DNS leak risk
- Use one consistent DNS policy in your proxy software and make sure rule matching does not fall back to local resolution.
- Use Fake-IP mode when appropriate, or let the proxy perform the real domain lookup remotely.
- Check for conflicts between browser secure DNS, operating-system DNS, and proxy DNS settings.
- Verify that IPv4, IPv6, UDP, DoH, and DoT all use the intended proxy or trusted resolver.
- After changing settings, clear the operating-system and browser DNS caches, then run this test again.
How to interpret a DNS path
Run the test after connecting your VPN and compare resolvers with its DNS settings. Third-party DoH, ISP forwarding, and anycast can affect results. A resolver in another country is not, by itself, proof of a leak.
Frequently asked questions
Does no observed resolver mean I am safe?
No. Caching, network blocking, or an unconfigured observer can prevent observations. Read the test status and retry; unavailable is not a passing result.
Continue checking your network
VPN checker: is my VPN working?
Check whether IP intelligence identifies your public exit as a VPN, proxy, or Tor node. Review evidence, then test DNS and WebRTC paths for possible leaks.
Open tool →WebRTC leak test
Test public WebRTC candidates through multiple STUN servers and compare them with your HTTP exit to investigate possible VPN or proxy bypass paths.
Open tool →What is my IP address?
Find the public IPv4 or IPv6 address used to reach this site, with ISP and ASN information. Learn how public, private, and VPN exit IPs differ.
Open tool →