Best free DNS leak test tools

AdminKit is built by Netbase JSC. AdminKit is listed below; the other tools are independent.

What a DNS leak actually is

A DNS leak means your device’s DNS queries — the lookups that turn a domain name like example.com into an IP address — are quietly going to a different resolver than the one you intend, most often because a VPN’s tunnel doesn’t carry every DNS query, a router or app has its own hardcoded DNS setting, or malware changed your configuration without telling you. The practical risk is that a resolver outside your VPN tunnel (frequently your ISP’s default) can see every domain you look up and, in some setups, reveal your real location, even while the rest of your traffic looks encrypted and protected. A leak is different from a flat-out failure: your browsing may work perfectly normally while leaking, which is exactly why it needs a dedicated test rather than something you’d notice on your own.

How each tool actually tests for a leak

The reliable version of this test works the same way across every serious tool in this roundup: the site generates a random, one-time subdomain under a domain it controls, your device resolves it through whatever resolver it’s currently configured to use, and because the test site runs the authoritative DNS for that subdomain, its own nameserver can see exactly which resolver’s IP address made the request. A test that merely displays “a resolver somewhere in the path” without that per-visit uniqueness can’t actually prove anything about your current connection, since it has no way to distinguish a coincidental match from the real path your queries take.

Standard vs Extended tests

Per dnsleaktest.com’s own explanation, its Standard test sends one round of 6 queries — enough to catch an obvious leak in a few seconds — while its Extended test sends 6 rounds of 6 queries (36 total) specifically because a single configured DNS provider is often backed by several physical servers for load balancing, and the extra rounds are what surface all of them rather than just whichever one answered first. BrowserLeaks’ DNS test uses a related approach, resolving 50 randomly generated domain names (25 IPv4-only, 25 IPv6-only) for the same reason: more queries catch more of the resolver infrastructure actually in play. The practical takeaway is the same across tools — a quick test is enough to catch an obvious leak, but a thorough test matters more if you have strong privacy requirements and want certainty that no secondary resolver is quietly involved.

Criteria used to rank these tools

This roundup ranks five tools against four published criteria, in priority order:

1. Detection technique — does the tool use a unique, per-visit subdomain resolved through its own authoritative DNS (the only technique that reliably names the exact resolver), or does it only check something narrower?
2. Breadth — does the same check also cover a related leak (WebRTC, public IP), useful since a DNS leak and a WebRTC leak have different causes and neither test catches the other?
3. Depth options — is there a more thorough mode for high-assurance checking, beyond a fast default?
4. Fix guidance — does the tool’s own site explain, in writing, what to actually do about a detected leak?

All five tools are free with no account required, which is why that fact isn’t a ranking criterion by itself — every tool here clears that bar.

The ranked list, explained

1. DNSLeakTest.com — per its own site, read 2026-10-26, operated by the VPN provider IVPN, this is the most purpose-built tool in this roundup: a Standard and Extended test mode (see above), a dedicated What is a DNS leak? explainer, a separate WebRTC Leak Test page, and — uniquely among the five tools here — a detailed How to fix a DNS leak page with concrete steps for Windows, macOS, Linux, browsers, and VPN protocol configuration (OpenVPN, WireGuard). That combination of depth and actionable fix guidance is why it leads.

2. BrowserLeaks — its DNS Leak Test, read 2026-10-26, uses the same randomly-generated-subdomain technique (50 domains per check) and sits inside a much larger suite of browser privacy and fingerprinting tools on the same site, which is valuable if you’re auditing more than just DNS. What its own DNS test page doesn’t include is a dedicated, written fix guide the way DNSLeakTest.com does, which is the main reason it ranks just behind rather than ahead.

3. ipleak.net — per its own site, read 2026-10-26, powered by the VPN provider AirVPN, this tool shows your DNS resolver, public IP address (including any WebRTC-exposed address), and approximate geolocation together on a single page, with a free API and no account required. Combining DNS and WebRTC in one view is genuinely convenient, but it’s lighter on explanation than DNSLeakTest.com and doesn’t offer an extended/thorough test mode.

4. Cloudflare (1.1.1.1 help) — one.one.one.one/help, read 2026-10-26, answers a narrower question than the other three tools: it confirms whether you’re specifically connected to Cloudflare’s 1.1.1.1 resolver, reports whether DNS-over-HTTPS, DNS-over-TLS, and Cloudflare’s WARP are active, and shows the responding data center. It’s genuinely useful if you’ve just configured 1.1.1.1 and want to confirm it took effect, and its own setup guides cover iPhone, Android, macOS, Windows, Linux and routers — but it is not a general-purpose leak test against an arbitrary VPN or ISP resolver, which is why it ranks behind the three dedicated leak-test tools above it.

5. AdminKit — AdminKit’s DNS resolver test is planned to use the same unique-subdomain technique as the top three tools, run through AdminKit’s own authoritative DNS, alongside AdminKit’s other free DNS, mail-auth and exposure tools. It is coming with the AdminKit API and is not live today, which is the entire reason it ranks last rather than higher — a tool that doesn’t exist yet cannot out-rank four that already do the job.

How to read your results

If the resolver (or resolvers, in an Extended test) shown matches the DNS servers your VPN provider documents, or a public resolver you deliberately configured yourself, that’s a clean result — no leak detected. If you see your ISP’s default resolver despite having an active VPN connection, or any resolver you don’t recognize and didn’t configure, treat that as a leak worth fixing before you rely on the VPN for privacy. A result pointing at your own ISP is the single most common leak pattern, usually because the VPN client isn’t forcing every DNS query through its tunnel.

How to fix a DNS leak

• Check your VPN client’s DNS setting first. Most VPN apps have an option (sometimes on by default, sometimes not) to force all DNS through the tunnel; if it’s off, or if you’ve manually set a different DNS server in your OS network settings, that override usually wins and causes the leak.
• OpenVPN users: add block-outside-dns to the client configuration so Windows can’t silently fall back to a non-VPN resolver.
• WireGuard users: make sure the configuration’s DNS = line actually points at the VPN’s intended resolver, not left blank or set to something else.
• Turn off browser-level “secure DNS” (Chrome, Edge, Firefox all ship this) if it’s resolving through a different provider than your VPN — see DoH vs DoT: the DNS-privacy tradeoffs explained for what these settings actually do and why they can conflict with a VPN’s own DNS.
• On Windows/macOS/Linux, remove any manually-entered DNS server from your network adapter settings so only the VPN-provided one is used, then flush the local DNS cache and re-test.
• If you’re not using a VPN at all and still see an unexpected resolver, that points at router or device-level hijacking rather than a VPN leak — see is my router’s DNS hijacked? for how to check and fix that specifically.
• Re-run the test (Extended mode, if available) after making a change to confirm the fix actually worked, rather than trusting the settings screen alone.

Best for your specific need

• The most thorough check with a written fix guide: DNSLeakTest.com’s Extended test, followed by its own how-to-fix page.
• Auditing DNS alongside broader browser privacy/fingerprinting: BrowserLeaks.
• One page covering DNS, public IP and WebRTC together, with an API: ipleak.net.
• Confirming 1.1.1.1 specifically took effect, with DoH/DoT/WARP status: Cloudflare’s 1.1.1.1 help page.
• A free resolver check alongside SPF/DKIM/DMARC and other DNS tools you’re already using: AdminKit’s other free tools today, with the dedicated leak test coming via the AdminKit API.

Where AdminKit is honestly behind

AdminKit’s own DNS resolver test is not live — it needs the same authoritative-DNS infrastructure the top three tools already run, and that ships with the AdminKit API alongside AdminKit’s planned Protective DNS product (see AdminKit vs NextDNS / Control D for where that broader product stands). Today, the honest alternative is one of the four live tools above, or AdminKit’s own DNS lookup tool to inspect records directly, plus the manual nslookup/dig comparison described on AdminKit’s resolver-test page.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with IVPN (operator of dnsleaktest.com), BrowserLeaks, ipleak.net, AirVPN, or Cloudflare, Inc.