Skip to content
LunoVPN
Free tool

DNS leak test

Short answer

A DNS leak happens when your device looks up domain names through your internet provider instead of through your VPN. Your traffic stays encrypted, but the list of sites you visit does not stay private. This test asks your device to resolve a set of unique hostnames and reports which resolvers answered.

dns-leak-test READY
// press the button. The test issues lookups for unique hostnames under a wildcard domain and reports which resolvers answered them.

This test needs a wildcard DNS endpoint on our own infrastructure to observe which resolver performs each lookup — it is not something a page can determine on its own. Where that endpoint is unavailable the test says so plainly rather than inventing a result.

Background

Why a leak matters more than it sounds

Every time you open a site, your device first asks a resolver to turn the name into an address. That request is small, unencrypted by default, and enormously revealing: it is a timestamped list of everywhere you go, in order.

When a VPN is working properly, those lookups travel inside the tunnel and are answered by the VPN. When it leaks, they go to your internet provider instead, and the provider ends up with the one thing most people bought a VPN to avoid handing over. The encrypted tunnel is still doing its job on the traffic itself, which is what makes this so easy to miss: everything looks fine.

An encrypted tunnel with leaking DNS is a locked envelope with the address list stapled to the outside.

The usual causes

  • Operating system behaviour. Windows has historically queried every network interface at once and used the fastest reply, which frequently means your provider.
  • IPv6. If your connection has IPv6 and the VPN only handles IPv4, lookups can escape over the untunnelled protocol.
  • Split tunneling. Useful, but if the browser is routed outside the tunnel then so are its lookups.
  • Manually set DNS. A resolver you configured yourself may be honoured ahead of the VPN’s.

How LunoVPN handles it

Every client resolves DNS inside the tunnel and enforces that at the system level rather than merely suggesting it, on Windows, macOS, Linux, Android and iOS. Lookups are answered in memory and never written down. If the tunnel drops, the kill switch stops traffic rather than letting the operating system quietly fall back.

FAQ

DNS leak questions

What is a DNS leak?
A DNS leak is when your device asks your internet provider's DNS servers to look up a domain even though you are connected to a VPN. The traffic itself stays encrypted, but the lookups reveal every site you visit to the provider you were trying to keep them from. It defeats a large part of the point.
How do I know if I have a DNS leak?
Run the test above while connected to your VPN. If the resolvers that answer belong to your own internet provider rather than your VPN, you have a leak. A correctly configured VPN answers every lookup itself.
What causes DNS leaks?
Usually the operating system rather than the VPN: Windows in particular has historically sent lookups to every configured interface at once and used whichever replied first. Split tunneling, IPv6 that the VPN does not handle, and manually configured DNS servers are the other common causes.
How do I fix a DNS leak?
Use a VPN that handles DNS itself and enforces it at the system level, which LunoVPN does by default on every platform. Beyond that, disable any manually configured DNS servers, make sure IPv6 is either tunnelled or disabled, and check whether split tunneling is routing your browser outside the tunnel.
Does LunoVPN leak DNS?
It shouldn't. Every client resolves DNS inside the tunnel and blocks lookups from escaping to other interfaces, and the kill switch stops traffic entirely if the tunnel drops. If you find otherwise we would genuinely like to know — our bug bounty pays for exactly this kind of finding.
Is a DNS leak the same as a WebRTC leak?
No, though people confuse them. A DNS leak exposes which sites you look up. A WebRTC leak can expose network addresses directly to a web page through the browser technology behind video calls. They have different causes and different fixes — our WebRTC test covers the other one.

Also worth checking

DNS is one of several ways a connection gives you away.

WebRTC leak test Browser fingerprint Full privacy check