Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To test a VPN for DNS leaks, compare the same device, browser, and network with the VPN disconnected and connected. Record the DNS resolvers shown in both states, then check public IP, IPv6, and WebRTC separately. A changed public IP proves only that your apparent internet address changed; it does not prove that DNS queries, IPv6 traffic, or browser WebRTC traffic use the tunnel. Use the VPN provider’s documented resolver design to judge whether a listed resolver is expected, and repeat the checks after network changes or configuration edits.
What is a VPN DNS leak, and why does the test matter?
A DNS leak occurs when a device sends a domain-name lookup to a resolver outside the route you intended the VPN to protect. DNS converts names such as example.com into IP addresses. If those lookups go to an ISP or local-network resolver while the rest of your traffic uses the VPN, the resolver may be able to observe the domains being requested.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe resolver’s IP address does not have to match the VPN’s exit IP. A VPN can legitimately send DNS to its own infrastructure, including a resolver hosted in a different data center, or to a documented third-party service. The meaningful comparison is whether the resolver belongs to the expected VPN path and whether it differs from your VPN-off baseline. Provider documentation explains this distinction and the circumstances that can let queries escape.
DNS, public IP, IPv6, and WebRTC are separate evidence streams. Passing a DNS test does not establish that IPv6 or WebRTC is protected, and a changed public IP does not establish that DNS is protected. AMTSO’s VPN testing guidance treats each as a distinct check and also recommends testing network transitions and split tunneling.
#1 Best Overall
What should I prepare before testing?
Keep the test controlled so that a difference is attributable to the VPN rather than to a changed network or browser.
- Use one device, one browser, and one internet connection for the VPN-off and VPN-on runs.
- Temporarily identify other routing layers, such as another VPN or Apple iCloud Private Relay. Disable them if you want to measure only the VPN under test, or record that they remain enabled.
- Know how your VPN says it handles DNS, IPv6, custom resolvers, split tunneling, and a dropped connection. A resolver branded Google, Cloudflare, or another public service is not automatically a leak.
- Use a service that reports the resolvers it observes, not only a pass/fail badge. DNSLeakTest.com provides standard and extended DNS tests; the extended test generates more lookups and can reveal additional resolvers.
- Record the date, VPN server or location, protocol if shown, and relevant app settings. Provider features can vary by platform and server.
How do I record a VPN-off baseline?
Disconnect the VPN completely, then capture the results that you will compare later. Do not change Wi-Fi, mobile data, browser, or DNS settings between the two main runs.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirm the VPN application reports disconnected. If another VPN or Private Relay is active, note it or turn it off according to your test plan.
- Open DNSLeakTest.com and run the standard test. Record every resolver hostname, IP address, and organization shown. Run the extended test if you want a broader list, and use the same test mode after connecting.
- Record your public IP address and the country or network organization reported by an IP-checking page. The exact page is less important than using the same page in both states.
- Check whether the device has an IPv6 address and whether the test page reports an IPv6 route. Write down the address or the fact that IPv6 is unavailable.
- Run the browser’s WebRTC leak check offered by your chosen test page and save the addresses it exposes. WebRTC results are browser- and permission-dependent, so keep the browser unchanged.
This baseline is not a verdict about the VPN. It shows which resolvers and addresses are normal for this device and connection when the tunnel is absent.
How do I run the same checks with the VPN connected?
Reconnect the VPN without changing the test conditions, wait for the app to show a stable connection, and repeat every check in the same order.
Rank #2
- Choose the VPN server and settings you normally use. If the provider documents different DNS or IPv6 behavior by server, record the selection.
- Verify the VPN app says connected before opening the test page. Do not rely on a notification that may remain visible after a connection interruption.
- Run the same DNSLeakTest.com mode used for the baseline. Record all resolver names, IPs, and organizations rather than relying on the page’s headline result.
- Repeat the public-IP check, IPv6 check, and WebRTC check in the same browser. Save the displayed addresses and connection state.
- Compare each signal separately: VPN-off resolver versus VPN-on resolver, expected VPN resolver versus observed resolver, IPv6 availability and route, WebRTC addresses, and the public IP.
Some providers recommend an extended DNS test because it performs more lookups. Proton VPN’s support instructions point users to DNSLeakTest.com and describe both standard and extended modes; follow the instructions for the particular client you use. See the provider’s DNS-leak guidance.
How should I interpret the resolver list?
Interpret the list against your baseline and the provider’s stated architecture, not by the resolver brand alone.
| Observation | What it can mean | What to do next |
|---|---|---|
| VPN-on results list the same ISP resolver seen with the VPN off | DNS may still be using the local or ISP path, although a provider could document an intentional design. | Check the provider’s DNS documentation, then inspect custom DNS and leak-protection settings. |
| VPN-on results list the VPN provider’s resolver or documented infrastructure | DNS is likely following the provider’s intended route for that client and server. | Confirm with a second run and test transitions if they matter to you. |
| VPN-on results list Google, Cloudflare, or another public DNS brand | The VPN may intentionally route to that third party; the brand alone does not prove a leak. | Compare the result with the provider’s published DNS behavior and the VPN-off baseline. |
| The resolver organization changes but the VPN exit IP remains stable | Resolver traffic and ordinary internet traffic can use different addresses and infrastructure. | Judge the resolver against documented VPN routing, not against the exit IP. |
| Resolver results change between repeated connected tests | Load balancing, server selection, browser cache, or a connection transition may be involved. | Repeat with the same server and settings, clear only the test page’s state if needed, and document each result. |
A DNS test reports where the tested lookups were resolved. It does not prove that every application on the device uses the same resolver, nor that traffic stayed inside the tunnel during a brief interruption.
How do I check public IP, IPv6, and WebRTC independently?
Run these checks even when DNS appears protected. They answer different questions and can fail independently.
Public IP
With the VPN connected, the public IPv4 address should normally differ from the VPN-off address and correspond to the selected VPN location or provider network. A changed address only describes the route used by the IP-check request; it says nothing about DNS or WebRTC.
IPv6
Check whether an IPv6 address is present before and after connecting. A VPN client may disable IPv6, tunnel it, or support it only on particular platforms or servers. If an IPv6 address appears outside the provider’s documented route, investigate the client’s IPv6 leak protection rather than applying a universal operating-system tweak. Provider documentation on IPv6 support illustrates why behavior depends on the client, operating system, and server.
WebRTC
WebRTC can expose network addresses to a web page through browser APIs. Record the addresses shown with the VPN off and on, and note browser permissions or extensions that affect the result. A browser test covers that browser and connection state; it does not establish how a desktop application, game, command-line tool, or another browser behaves.
How can I test Wi-Fi changes, mobile handoffs, and split tunneling?
A VPN that looks clean while stationary can behave differently during a route change. Test transitions that match how you actually use the device.
Rank #4
- Wi-Fi access-point change: Start a connected test, move between access points, wait for the VPN to report connected again, and repeat DNS, IP, IPv6, and WebRTC checks.
- Wi-Fi-to-mobile transition: With the VPN active, disable Wi-Fi or leave its range, allow mobile data to take over, and test again. Repeat in the opposite direction if both transitions matter.
- Split tunneling: Test an application included in the tunnel and one explicitly excluded. DNS behavior can differ by application or route, so record which app generated each lookup.
- VPN interruption: Briefly disable the network or switch servers, then observe whether the client blocks traffic until the tunnel returns. A browser page that was already open may not reveal a short escape.
AMTSO states the expected transition behavior plainly: “When connected to a VPN server and while the device is switching Wi‑Fi access points no data packets should exit the device unencrypted (via any other network interface except the VPN interface).” Use the guidance as a test objective, while recognizing that the exact controls depend on the VPN client and operating system.
What should I do if the test shows an unexpected DNS resolver?
First confirm the result, then remove configuration causes one at a time. Do not assume that changing the operating system’s global DNS address will fix a VPN client that manages DNS internally.
- Reconnect the VPN and rerun the same DNS test. Confirm that the app still reports connected and that the resolver appears repeatedly.
- Review custom DNS settings in the VPN app and the operating system. A manually configured resolver can override or compete with the client’s DNS protection.
- Check the VPN app’s DNS-leak or DNS-protection control, if it has one, and enable the setting recommended for your platform.
- Inspect split-tunnel rules. An excluded browser or helper process may resolve names outside the tunnel by design.
- Check IPv6 leak protection separately. An apparently clean IPv4 DNS result does not cover an IPv6 path.
- Test after a server change and after a network transition. If only one server or transition produces the unexpected resolver, preserve the timestamps and settings for the provider’s support team.
- Use the client’s kill switch or network-lock feature where available, especially if your priority is preventing traffic during a VPN interruption. Verify its behavior with a controlled disconnect rather than assuming the label guarantees coverage.
Proton VPN identifies custom global DNS settings and a VPN interruption as circumstances that can allow queries to escape, while its IPv6 documentation notes platform- and server-specific differences. Those are examples of why troubleshooting must follow the client’s own documentation rather than one universal operating-system recipe. DNS troubleshooting details and IPv6 details are available from the provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can a browser DNS-leak test prove—and what can’t it prove?
It proves what the test page observed for its own DNS lookups, browser, device, and current connection. It cannot certify every application, protocol, interface, or future network transition.
- Operating-system services, email clients, games, containers, and command-line tools may use separate DNS APIs or hard-coded resolvers.
- Browser DNS-over-HTTPS settings, extensions, cached answers, and permissions can alter what a page observes.
- A test performed on one Wi-Fi network says nothing about a later mobile handoff or a different access point.
- Split-tunnel exclusions intentionally route selected applications outside the VPN and should be evaluated against your policy, not automatically labeled a leak.
- Resolver geolocation and ownership databases can be incomplete. Use the VPN provider’s documentation to identify its infrastructure.
For a high-confidence check, repeat the controlled comparison after each material change: VPN server, protocol, DNS setting, browser setting, split-tunnel rule, operating-system update, or network type.
What is the shortest reliable checklist?
- Fix the device, browser, and network.
- With the VPN off, record DNS resolvers, public IP, IPv6, and WebRTC.
- Note other routing layers such as another VPN or Private Relay.
- Connect the VPN and run the identical tests.
- Compare resolver identity with the VPN-off baseline and the provider’s documented design.
- Check IPv6 and WebRTC independently; do not infer their status from the public IP.
- Repeat after Wi-Fi changes, Wi-Fi-to-mobile handoffs, split-tunnel changes, or a VPN interruption when those scenarios are relevant.
- If a resolver remains unexpected, review custom DNS, DNS protection, IPv6 protection, split tunneling, and kill-switch behavior, then test again.
Frequently Asked Questions
Can a DNS leak happen even when my VPN shows a different IP address?
Yes. The public-IP check and DNS lookup can take different routes. A changed exit IP does not show which resolver handled the domain lookup, so compare the resolver list separately.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does seeing a Cloudflare or Google resolver mean my VPN is leaking?
Not necessarily. Some VPNs intentionally use third-party resolvers. Treat the result as unexpected only when it conflicts with the provider’s documented DNS design or your VPN-off comparison.
Should I use the standard or extended DNSLeakTest.com test?
Use the standard test for a quick repeatable comparison, and the extended test when you want more lookups and a fuller resolver list. Use the same mode before and after connecting so the results remain comparable.
Why do my results change when I switch from Wi-Fi to mobile data?
A network handoff can change interfaces, routes, IPv6 availability, and VPN state. Run the same DNS, IP, IPv6, and WebRTC checks after the handoff and verify that the VPN has re-established its protected route.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
