PantheraProject
Language:en

DNS leak test

Run a real DNS leak test: we observe which recursive DNS resolvers query our authoritative server, so you can confirm your VPN's DNS protection is working.

Last updated: 1 min read By: Panthera Project Editorial Team

On this page
  1. How this test works
  2. Reading the results
  3. Fixing a DNS leak
  4. Limitations

How this test works

This is a genuine DNS leak test, not an IP lookup with a new label:

  1. Your browser asks our server for a unique, random test token.
  2. It then requests several hostnames made from that token under a DNS zone that our own server is authoritative for.
  3. Your device can’t know these addresses, so whichever recursive resolver your system uses must ask our authoritative server.
  4. We record the source address of each resolver that asks for your token and show it with its approximate location and operator.

Tokens expire after 10 minutes. We store only resolver addresses against a random token, never your own IP.

Reading the results

You see Likely meaning
Resolvers operated by your VPN provider DNS is protected ✅
Your ISP’s resolvers while the VPN is on DNS leak. Enable the VPN’s DNS leak protection or its own DNS
Public resolvers (Cloudflare, Google, Quad9) Expected if you or your browser chose them (e.g. DNS over HTTPS)
Many resolvers in different places Normal for large anycast resolvers; check who operates them
Nothing The test hostnames were blocked, or the test server is not active on this deployment

Fixing a DNS leak

  • Turn on the VPN app’s DNS leak protection and kill switch.
  • Disable “smart” multi-homed name resolution on Windows if your VPN recommends it.
  • Make sure IPv6 is either tunnelled or disabled. IPv6 DNS can bypass IPv4-only VPNs.
  • Check browser settings. Secure DNS (DoH) sends queries to the resolver you chose, inside HTTPS, regardless of the VPN.

Limitations

  • We observe the resolver that contacts us. Resolvers that forward to an upstream may show only the upstream.
  • Some enterprise networks and privacy extensions block unusual subdomains, which produces an empty result. That is not proof of protection.

Frequently asked questions

What is a DNS leak?

When you use a VPN, your DNS lookups should go through the VPN to the provider's resolver. A leak happens when lookups bypass the tunnel and reach your ISP's or another resolver, revealing which sites you visit.

I see Google or Cloudflare resolvers. Is that a leak?

Not necessarily. If you configured that public resolver yourself or your browser uses DNS over HTTPS, it is expected. It is a leak if you expected the VPN's resolver and see a different one, especially your ISP's.

Related