Learn
DNS leaks — what they are and the honest browser limit
Understand DNS leaks and why a browser alone cannot name your resolver.
What it detects
Before your browser can reach a site it asks a DNS resolver to turn the hostname into an IP address. A “DNS leak” happens when those lookups go to a resolver outside your VPN tunnel — for example your ISP’s resolver — revealing your browsing to a party you were trying to bypass.
Honest limit: DNS resolution happens below the browser’s fetch API, so JavaScript running on this page cannot see which resolver actually answered. A trustworthy DNS-leak test needs a controlled authoritative DNS server behind a unique hostname that records the resolver out-of-band. Where we have no such endpoint, we report this check as unavailable rather than guess.
Why it matters
If your DNS requests leak to your ISP, they can log the domains you visit even while a VPN hides the content of your traffic. For a privacy-focused user, DNS leaks quietly undo much of the point of the VPN.
How to read your result
Treat an in-browser “no leak” claim with suspicion — the browser genuinely cannot confirm it. A dedicated DNS-leak service that shows you the resolver IPs it recorded server-side is the reliable way to test.
Here the honest status is “unavailable” or “inconclusive”; use it as a prompt to test with a tool that runs its own DNS endpoint.
Frequently asked questions
- Why does this test say “unavailable”?
- Because a web page cannot observe your DNS resolver — the lookup happens in the operating system, invisible to JavaScript. Rather than fabricate a result, we report the limit honestly.
- How do real DNS-leak tests work?
- They resolve a unique random hostname served by their own authoritative DNS server, then read back which resolver IPs asked for it. That server-side observation — not the browser — reveals the leak.
- How do I stop DNS leaks?
- Use a VPN that tunnels DNS through its own resolvers, enable its leak-protection or kill-switch, and avoid manually setting a third-party resolver that bypasses the tunnel.