DNS leak test
DNS Leak Test
Check whether DNS exposes your real network.
How to read your DNS leak result
Public DNS, your current network and unfamiliar networks produce different results.
No leak detected
Public DNS
Public DNS uses global nodes. A different country does not mean your DNS is leaking.
No leak detected
Same network
The DNS server and your current IP use the same provider. No DNS leak was detected.
Possible leak
Unfamiliar network
The DNS server is neither public DNS nor part of your current network. A DNS leak may be present.
What to do if a DNS leak may be present
Check these settings in order. Reconnect and test again after each change.
- Enable DNS leak protection in your VPN or proxy client.
- Review browser Secure DNS. Do not select a separate resolver.
- Review split-tunnel rules. Route DNS and web traffic through the same proxy.
- Disconnect and reconnect your proxy or VPN, then run the test again.
Frequently asked questions
What does this DNS leak test detect?
It identifies the DNS servers handling this test and checks for servers that may expose your real network. Results include each server's IP, provider and country or region.
Does a different DNS country always mean a leak?
No. Public DNS services use global and anycast networks, so their registered country may differ from your current IP. EnvTrace does not identify Cloudflare, Google Public DNS, Quad9, OpenDNS or NextDNS as a leak from country alone.
What indicates a possible DNS leak?
A possible leak is shown when a non-public DNS server belongs to a clearly different network from your current IP. Public DNS and weak evidence are not identified as leaks.
How do I fix a possible DNS leak?
Enable DNS leak protection in your VPN or proxy client. Review browser Secure DNS and split-tunnel settings, reconnect, then run the test again.
Does EnvTrace store the domains I visit?
No. The test generates random EnvTrace domains and stores only the resolver IPs observed for that test. Test results expire after 10 minutes.