Free checks · No sign-up · Nothing stored
DNS Leak Test
Which resolver answered, and whether that network is the one this page loaded from. A public resolver such as Cloudflare is not called a leak on its own.
What this test does that others don't
Other testers: Cloudflare shows up during a DNSSEC check and is sold as a leak.
This test: Public resolvers are named and not called a leak on their own.
Other testers: Say nothing about Chrome Secure DNS or Firefox DoH.
This test: Says when the browser's Secure DNS is the likely reason.
Other testers: The extended test hides behind a second button.
This test: Twelve lookups are the normal test.
Checking
Asking which resolvers answer.
Twelve lookups run, which is the extended test. A public resolver is named, and it is not called a leak by itself.
This sees the resolver this browser used for these lookups, not every program on the computer.
Questions people actually ask
Why do two DNS leak tests disagree?
They ask different questions. One lists every resolver that touched any query, including a validator used for DNSSEC. Another lists only the resolver that answered ordinary lookups. A validator that appears in one list is not automatically your ISP seeing your traffic.
Why does one test show Cloudflare and another does not?
Cloudflare runs both a public DNS service and infrastructure other tests trip over during DNSSEC checks. If Cloudflare's public DNS answered your lookups, this page says so and explains the usual causes: the browser's Secure DNS, or a VPN that uses Cloudflare on purpose. It does not print Leak for that alone.
Does this see every app on the computer?
No. This sees the resolver the browser used for these lookups. Another program can use a different resolver. A passing result here is about this browser, at this moment.
What is Secure DNS doing here?
Chrome's Secure DNS and Firefox's DNS over HTTPS can send lookups to Cloudflare or Google even while a VPN is connected. The IP looks like the VPN and the DNS does not. Turn Secure DNS off and run the test again before calling that an ISP leak.
Country and network names come from DB-IP, used under CC BY 4.0.