DNS leak test - what a browser can check, and how to check the rest in one command
The short answer. A DNS leak is when your device sends its DNS questions (which names you visit) to your internet provider's resolver instead of through the VPN. A website cannot see this on its own: it needs its own DNS zone and random names. You can check it yourself with one command, nslookup -type=txt o-o.myaddr.l.google.com, which prints the IP address of the resolver that asked Google on your behalf. If that address belongs to your internet provider rather than your VPN, DNS is leaking.
Why this site has no one-click DNS leak test
The one-click tests on VPN sites work by owning a domain and its authoritative name servers. The page asks your browser to load a few random names under that domain, such as x7f3k.leaktest.example; your device's resolver has to ask their name servers for each one, and those servers record the resolver's IP address. Without that server, the page has no way to learn which resolver your operating system uses: browsers do not expose it.
We do not run such a server yet, so we do not offer a "DNS leak test" button. A page that only asked a public DNS-over-HTTPS resolver would test that public resolver, not your system, and would report "no leak" for everyone. That would be worse than no test.
Check it yourself in one minute
- Turn the VPN on.
- Open a terminal (Windows: Command Prompt; macOS and Linux: Terminal) and run:
nslookup -type=txt o-o.myaddr.l.google.com
- Read the address in quotes in the answer. It is the public IP address of the resolver that sent the question to Google. (On macOS and Linux,
dig +short TXT o-o.myaddr.l.google.comprints the same.) - Paste that address into ASN Lookup and read the network name. If it is your VPN provider, or a public resolver the VPN uses such as Cloudflare or Google, DNS goes through the tunnel. If it is your home or mobile internet provider, DNS is leaking.
- As a second opinion,
nslookup whoami.akamai.netanswers with the resolver's IPv4 address in the same way.
The Server: line that nslookup prints at the top is the resolver your device talks to first, often your router at 192.168.x.x. That is normal; the address in the answer is the one that matters, because it is what the outside world sees.
The two checks a browser can do
| Check | What it shows | Page |
|---|---|---|
| Your public IP | the address every website sees for your connection; with the VPN on it should belong to the VPN | What Is My IP Address |
| WebRTC leak | whether the browser offers a different public address to sites through WebRTC, which can go around a VPN | WebRTC Leak Test |
| DNS resolver | which resolver your device uses | not possible from a web page; use the command above |
Run all three with the VPN on. Your IP should belong to the VPN, the WebRTC test should show no other public address, and the resolver should not belong to your own internet provider.
If DNS is leaking
- Turn on the VPN's own DNS or leak protection setting; most apps have one, sometimes called "use VPN DNS only".
- Windows: "Smart multi-homed name resolution" sends DNS questions out of every network adapter at once. VPN apps that block leaks switch this behaviour off; check the app's setting before changing system policy.
- IPv6: a VPN that tunnels only IPv4 can leave IPv6 DNS questions outside the tunnel. Choose a VPN setting that blocks or tunnels IPv6.
- Browser DNS-over-HTTPS: Firefox and Chrome can send DNS to their own resolver over HTTPS. That hides names from your provider but can bypass the VPN's resolver; decide which you want.
Questions people ask
What is a DNS leak?
A DNS leak happens when your device sends its DNS questions, the names of the sites you visit, to your internet provider's resolver instead of through the VPN tunnel. The traffic itself may be encrypted by the VPN, but the provider still sees every domain name you look up, which defeats much of the privacy a VPN is used for.
Can a website test for DNS leaks without software?
Only a website that runs its own authoritative DNS server can. It makes your browser look up random names under its domain and records which resolver asks for them. A page without that server cannot see your resolver, because browsers do not reveal it. Running nslookup -type=txt o-o.myaddr.l.google.com gives the same answer in one command.
How do I know if my VPN leaks DNS?
With the VPN on, run nslookup -type=txt o-o.myaddr.l.google.com and look up the address it returns in an IP lookup tool. If the network belongs to your home or mobile internet provider, DNS is leaking. If it belongs to the VPN provider or a public resolver the VPN uses, DNS goes through the tunnel.
Is a WebRTC leak the same as a DNS leak?
No. A WebRTC leak exposes an IP address: the browser offers sites a public address that does not go through the VPN. A DNS leak exposes the names you look up to your internet provider. A VPN can have either, both or neither, so test them separately with a WebRTC leak test and the nslookup command.
Why does nslookup show my router as the server?
The Server line names the first resolver your device asks, usually the router at an address such as 192.168.1.1, which forwards questions onwards. That is normal. The address inside the answer to o-o.myaddr.l.google.com is the resolver that finally reached Google, and that is the one that shows whether DNS leaves through your provider.
Sources
Checked 6 Oct 2026, on Windows 11: nslookup -type=txt o-o.myaddr.l.google.com answers with the public address of the resolver that queried Google (an IPv6 address of the internet provider's resolver on the test connection), and nslookup whoami.akamai.net answers with that resolver's IPv4 address. Both names are run by Google and Akamai for exactly this purpose and are not part of any standard; if either stops answering, use the other.