Log In Get Started
Free tool

DNS Leak Test

A DNS leak is when your traffic runs through a VPN, but website names are resolved by your provider's own resolver: the address is hidden, but the list of sites is not. A browser cannot see this on its own, so the check works from the other side: you request a few random names in our zone, and we show which address came asking for them. That address is your resolver.

The check takes a few seconds and installs nothing.

Ready to test

Click "Test DNS", it takes a few seconds.

How to read the result

Two things are compared: the network you went out to the internet from, and the network that came asking for names. There are exactly three possible outcomes.

What you seeWhat it means
Same networkThe resolver is on the same network as your exit: DNS queries take the same path as your traffic. For a VPN connection, this is the correct picture.
Same country, different networkSomeone else, your provider or a public DNS, resolves the names. Without a VPN, that is expected. With a VPN on, it means a third party sees the names.
Different countryRequests bypass the tunnel, most often reaching the provider that gave you internet access. Your address stays hidden, but the list of sites does not.

Limits of this test

We see the resolver's address, not the person's: between you and our server there can be a chain, a home router, a provider's forwarder, and a public DNS, and only the last one in the chain reaches us. There can be more than one resolver: that is normal, the system queries them in turn. If the list is empty, it means the request never reached our zone, which happens when a network blocks unfamiliar domains or an extension blocks the request.

Also worth checking: whether the VPN works as a whole, whether WebRTC exposes your real address and whether IPv6 bypasses the tunnel.

Does your provider see the names?

In the 404 VPN app, DNS queries are intercepted and sent inside the tunnel, to 1.1.1.1 over DNS-over-HTTPS through our server. Your provider sees one encrypted connection instead of a list of sites.

How to connect 404 VPN →

Frequently Asked Questions

guest@404vpn:~$ cat dns-leak-faq.md
[01] $ How is a DNS leak different from an IP leak? ▸
> An IP leak reveals your address, meaning where you are. A DNS leak reveals names: your provider sees that you asked for a certain site's address, even if the traffic to that site itself runs through the tunnel and is encrypted. The list of sites you visited sometimes says more about a person than their IP address.
[02] $ The test showed Cloudflare or Google, but I did not configure anything. Is that a leak? ▸
> No, it means a public resolver is resolving names, not your provider. That happens for three reasons: "Secure DNS" is turned on in the browser itself, a public DNS is set in your system or router settings, or your VPN does it. Your provider does not see the names either way, the resolver's owner does. Whether that suits you is your call.
[03] $ I am not using a VPN. What should the test show? ▸
> Your provider's resolver, in your own country, and that is a normal picture. The tool answers one question: does the path of DNS queries match the path of traffic. Without a tunnel, it always matches, because there is only one path.
[04] $ What do you store? ▸
> The resolver's address, for a few minutes in the check server's memory so the page has time to fetch it; nothing is written to disk or a database. The names are random and tied to nothing, we do not need your own IP address for this test. Our server determines the country and network owner behind each address from its own database, third-party services take no part in it.
[05] $ How do I close a DNS leak? ▸
> There is one correct way: DNS queries need to travel inside the tunnel along with your traffic. The 404 VPN app does exactly that, requests are intercepted and sent to 1.1.1.1 over DNS-over-HTTPS through our server, so your provider sees one encrypted connection instead of a list of sites. If you set up the connection manually, check that a DNS server is set in the config and that it resolves through the tunnel, not "as set in the system".