DNS Leak Test

Most people only find out about DNS leaks after they have started using a VPN. They connect, check that their IP address has changed, and assume everything about their connection is now private. Then they run a DNS check and find their normal broadband provider still listed as the service turning website names into addresses. Their browsing is only partly hidden, and their ISP can still build a picture of the sites they visit.

This page explains what DNS is in plain English, what a leak actually means in a UK home, and how to read the test result at the top of this page. You will also find the common causes of leaks on UK broadband and the exact fixes, step by step, plus how to choose a safer DNS service if you want to change. No technical background is needed; everything is explained as it comes up.

What DNS means, in plain English

DNS stands for Domain Name System. It is best understood as the internet’s phone book. Computers reach websites using numbers called IP addresses, but people remember names like bbc.co.uk. When you type a name into your browser, a DNS resolver looks it up and returns the number, and your browser connects. This lookup happens constantly in the background, dozens of times for a single page once adverts, images and trackers are counted.

The important detail is who does the looking up. By default, the job goes to your broadband provider, using DNS servers set by your router or your provider’s network. BT, Virgin Media, Sky, TalkTalk and every other UK ISP run their own resolvers, and whoever runs the resolver can see the names you look up. They cannot see the full pages you read over a secure connection, but the list of sites is revealing on its own.

What a DNS leak is

A DNS leak happens when you are using a VPN — software meant to route your traffic through a private tunnel so your provider cannot watch — but your DNS lookups still travel outside that tunnel to your ISP’s resolvers. The VPN may be working perfectly for your actual web traffic while quietly letting the lookups slip past. Your provider cannot see the content of what you read, but it can see which websites you visit and when, which defeats much of the point of paying for a VPN.

Leaks also matter outside VPN use. If you have deliberately set a private DNS service on your router or browser, a leak means some lookups bypass it and go to your ISP anyway, so your settings are not doing what you think they are. The test at the top of this page shows exactly which organisations handled your lookups during the check, so you can compare that with who you expected to see.

How the test works

When you click the button, this page generates a random test identity and asks your browser to look up a handful of names it has never seen before. Those lookups have to pass through whichever resolver your connection really uses, and the test service records which resolver came asking. The page then asks the test service what it saw and lists the DNS servers for you, with the company behind each one and its country.

The page also shows your public IP address and its provider, fetched separately, so you can compare the two side by side. If you are on a VPN, your IP should show the VPN’s location while your DNS, on a healthy setup, should show the VPN provider or a neutral resolver — not your home ISP. The tool gives you a plain-English verdict, but treat it as strong guidance rather than absolute proof: only you know which VPN and provider you intended to use.

How to run the test properly

1. Get a baseline first. With your VPN switched off, run the test and note the provider names shown. On normal UK broadband this will usually be your ISP, and that is expected.
2. Connect your VPN. Wait until it says it is fully connected, and pick a server. A UK server is fine for this check.
3. Refresh this page and run the test again. Refreshing matters, because it clears any old result and makes sure the lookups happen under the VPN connection.
4. Compare the two runs. If your ISP has disappeared from the DNS list and been replaced by your VPN provider or a resolver you chose, there is no leak. If your ISP is still there, you have one.

Run the check separately on each device you care about — phone, laptop, tablet, smart TV. DNS settings live on each device and in each browser, so a clean result on your laptop says nothing about your phone.

What your result means

Your ISP appears in the DNS list while the VPN is on

This is a leak. Names like your provider’s brand, or network names belonging to it, in the DNS table mean lookups are reaching your ISP despite the VPN. Your page content is still encrypted by the VPN and by secure websites, but your provider can log the sites you look up. Work through the causes and fixes below.

Only your VPN provider (or a resolver you chose) appears

This is the result you want. Your lookups are being handled inside the arrangement you set up, and your ISP is not seeing them. For completeness, test again after reconnecting the VPN and after restarting your device, because some leaks only appear while a connection is being re-established.

A public resolver such as Cloudflare or Google appears

This is not, by itself, a leak. Many VPNs, browsers and routers deliberately use public resolvers like Cloudflare (1.1.1.1) or Google (8.8.8.8). It means your ISP is not handling your lookups. Whether it matches what you intended depends on your settings — if you set one of these services up yourself, the result is exactly right.

Several different companies appear

Multiple resolvers are common and usually fine: connections often use a main and a backup resolver, and modern browsers may use their own secure DNS on top of the system setting. What matters is whether your ISP is among them while a VPN is connected. If it is, that portion of your lookups is leaking.

The test cannot run

If the test service is blocked by an ad-blocker or privacy extension, or it is temporarily down, the tool says so and gives you a manual checking method instead of a false answer. A failed test is not evidence of a leak or of safety — it is no result at all.

Common causes of DNS leaks

• The VPN app’s leak protection is off. Many apps have a specific DNS leak protection or “use VPN DNS” setting, and it is not always on by default.
• Your browser’s Secure DNS. Chrome, Edge and Firefox can use their own encrypted DNS, chosen by the browser. Depending on the setting, it can bypass both your VPN and your router’s choices.
• Split tunnelling. If you have set some apps or websites to bypass the VPN, their lookups may go direct to your ISP too.
• Settings on the router. A router handing out the ISP’s DNS addresses to every device can undermine per-device settings, and a VPN installed only on one device leaves the rest of the house unprotected.
• Reconnect gaps. When a VPN drops and reconnects, or a laptop wakes from sleep, there can be a brief window where lookups use the ordinary connection.
• IPv6. On connections with IPv6 enabled, some setups tunnel the older traffic but let newer IPv6 lookups travel outside, producing a partial leak.

How to fix a DNS leak

1. Turn on your VPN’s DNS leak protection. Open the VPN app’s settings and look for DNS leak protection, “use only VPN DNS servers”, or similar, and switch it on. Reconnect and retest.
2. Use the VPN’s own DNS. If the app offers a choice of DNS, pick the VPN provider’s own servers rather than automatic or ISP options.
3. Check your browser’s Secure DNS setting. In Chrome or Edge, look under Privacy and security for “Use secure DNS”; in Firefox, under Privacy & Security for DNS over HTTPS. Set it to use your chosen provider, or turn it off so the browser follows the system and VPN.
4. Change the DNS on your device or router manually. Setting a resolver you trust in your network settings (see the options below) stops the ISP default from creeping back. Router-level changes protect every device at once.
5. Review split tunnelling. Remove anything from the bypass list that you do not genuinely need outside the VPN.
6. Retest after every change. Change one thing at a time and run the test again, here and with a fresh browser refresh, so you know which fix worked.

If a leak persists after all of that, contact your VPN provider’s support and tell them which device and app version you use. A reputable provider treats leak reports seriously and will have a known-settings fix. If they cannot solve it, that is a fair reason to switch providers.

Choosing a DNS service

You do not need a VPN to change who handles your lookups. Setting a different resolver on your router or device is free and takes a few minutes. Popular choices include Cloudflare (1.1.1.1), known for speed and a privacy promise not to log queries for advertising; Google Public DNS (8.8.8.8), fast and reliable but run by an advertising company; and Quad9 (9.9.9.9), which blocks known malicious domains as a bonus. UK ISP resolvers are usually fine for speed, since they sit close to you on the network, but they log lookups under the provider’s privacy policy and are subject to UK legal requirements, including the default adult-content filtering many households have switched on.

Changing DNS does not encrypt anything by itself and does not hide your activity from your ISP in the way a VPN does; your provider can still see which IP addresses you connect to. Think of it as choosing who keeps the phone book, not as invisibility. If your browser offers encrypted DNS (DNS over HTTPS), enabling it does hide the lookups themselves from the network between you and the resolver.

DNS leaks on UK broadband, specifically

A few UK quirks are worth knowing. Most big UK providers apply court-ordered blocks and optional parental filters at the DNS or network level, so a site that works through your VPN but not without it is often filtering, not a fault. ISP routers from BT, Sky and Virgin Media typically hand out the provider’s resolvers automatically and some lock those settings, which is why changing DNS on the device itself, or using your own router, is sometimes the only route. Finally, UK providers keep connection records under the Investigatory Powers Act; a DNS leak means the list of sites you look up may form part of what your provider can see and retain, which is exactly what VPN users are trying to avoid.

Frequently asked questions

Is a DNS leak dangerous?

It is a privacy problem rather than an immediate security emergency. Your passwords and page content stay encrypted, but the record of which sites you visit, and when, is exposed to your ISP (and retained under UK law). For most people that is an unwelcome surprise rather than a disaster; for journalists, activists and anyone whose browsing is sensitive, it matters much more.

How do I test for a DNS leak with my VPN?

Note your results with the VPN off, then connect the VPN, refresh this page and run the test again. If your normal ISP no longer appears among the DNS servers, you are not leaking. Full steps are in the section above.

Why do I see several DNS servers?

Backup and load-sharing are normal: systems keep a second resolver in case the first is slow, and browsers may add their own secure DNS. Multiple servers only signal a problem if your ISP is one of them while your VPN is connected.

Can my ISP see what I do online?

Without a VPN, your ISP handles your DNS by default and can log the sites you look up, though not the content of secure (HTTPS) pages. With a VPN working correctly, the ISP sees only an encrypted connection to the VPN server. A DNS leak punches a hole in that: the lookups become visible again.

Does changing DNS speed things up?

It can, slightly, if your provider’s resolvers are slow — pages may start loading a touch sooner. It will not change your download speeds, and the difference is usually small. Speed is a bonus, not the main reason to switch; privacy and reliability come first.

Is this test storing my results?

No. The check runs between your browser and the test services, and this page does not store or log your results. The test services themselves necessarily see the lookups made during the test, as explained in the privacy note by the tool.

The bottom line

A DNS leak is quiet but simple to check: run the test with your VPN off for a baseline, then with it on, and see whether your ISP is still handling your lookups. If it is, the fix is usually one setting in your VPN app or browser. Retest on every device, change one thing at a time, and you will know for certain that your private connection is actually private — not just switched on. Two minutes of checking beats assuming, and the check costs nothing but a couple of clicks.

Want to be thorough? Round out the picture with our What Is My IP tool to confirm the address and location your connection shows to the world, then run a broadband speed test once your settings are final, so you know the privacy changes have not cost you any performance. Together with this test, they give you the full state of your connection in under ten minutes of testing in the right order.