What is a DNS leak and how do you detect one?
A DNS leak happens when your device sends its domain name lookups outside the VPN or proxy tunnel, usually to your internet provider's resolver. Your traffic itself goes through the tunnel, but the list of sites you visit stays visible to your provider. A website can also see that its name was resolved by a server in your real country, not in the country your address belongs to.
What happens when you type a site's name
Devices connect to numeric addresses, not names. Before the browser can open example.com it has to look up its address, and that is the job of the Domain Name System. A lookup normally takes three steps:
- The operating system's stub resolver sends the question to a recursive resolver configured in the network settings. RFC 1034 describes this split between the two roles.
- The recursive resolver does the whole search on your behalf. It asks the root servers, then the top-level domain servers such as
.com, then the authoritative server that holds the site's records. - It returns the answer to your device and caches it for a set time. The browser then connects to the address it received.
A classic DNS query is unencrypted and goes to port 53, usually over UDP and sometimes over TCP, as defined in RFC 1035. Anyone on the path can read the name, and the recursive resolver sees it together with the address that asked.
The site's authoritative server never sees your device's address. It sees the address of the recursive resolver that asked it, and every leak test is built on that fact.
How a leak happens
With a full-device VPN, lookups are meant to travel inside the tunnel to a resolver chosen by the tunnel's operator. A leak is any lookup that takes another path, and the same causes come up again and again:
- The old resolver stays in place. If the VPN client does not change the DNS settings, the system keeps the resolver your router handed out. If that resolver sits on your local network, such as
192.168.1.1, the route to it is local and never enters the tunnel. - Parallel queries on Windows. By default Windows sends DNS queries across all connected networks at once to get a faster answer. Microsoft's documentation for the Turn off smart multi-homed name resolution policy describes this. A copy of the query then leaves through the normal network adapter alongside the tunnel.
- A program resolves the name before the proxy. With a SOCKS5 proxy, a program may resolve the name locally and send only the numeric address to the proxy. In curl, for example, the
socks5://scheme resolves on your device andsocks5h://lets the proxy resolve. See SOCKS5 vs HTTP proxy for details. - A resolver with an IPv6 address. If the tunnel carries only IPv4 and your router advertises an IPv6 resolver, queries can go to it outside the tunnel. IPv6 leaks covers this case.
- The tunnel drops. In the seconds while the tunnel is down or reconnecting, lookups fall back to the normal network unless a kill switch blocks them.
- A browser setting of its own. Some browsers can run encrypted DNS to a provider they pick. The query stays encrypted, but it goes to a different server from the one the tunnel sets. See DNS over HTTPS.
In every one of these cases, someone sees the site's name next to your real address: your provider, or whoever runs the resolver that got the query. The pages themselves are not affected and still travel through the tunnel.
Who resolves the name for each connection type
| Connection | Who resolves names | Leak risk |
|---|---|---|
| Full-device VPN that sets a resolver inside the tunnel | The tunnel operator's resolver | Low while the tunnel is up |
| VPN that leaves DNS settings alone | Your ISP's or router's resolver | High |
| HTTP or HTTPS proxy | The proxy, because the program sends it the site's name in the request | Low, for the configured program only |
| SOCKS5 with local name resolution | Your device, through your ISP's resolver | High |
| SOCKS5 with remote name resolution | The proxy | Low, for the configured program only |
A proxy applies only to the program it is configured in. Every other program on the device resolves names the usual way, which is not a leak but the limit of the tool.
How to test your connection
The tester asks for a unique subdomain under a domain it controls. Your resolver has no cached answer, so it must ask that domain's authoritative server. The authoritative server logs who asked, which tells the tester which resolver your device really uses.
Some domains hand your resolver's address straight back to you, and one command is enough on Windows, Linux and macOS:
nslookup whoami.akamai.net
nslookup -type=TXT o-o.myaddr.l.google.comThe Server line in the output is the resolver configured on your device, which may be an internal tunnel address. What matters is the answer itself: an A record for the first command, and quoted text for the second.
- Run both commands with the tunnel up and copy the address in the answer.
- Look it up with the IP lookup tool to see its network and country.
- Compare it with the exit address shown by the What is my IP tool. If the resolver belongs to your home ISP, your lookups are leaking.
- Test again after reconnecting, and after switching from Wi-Fi to mobile data. Many leaks only appear at the moment the network changes.
The tool linked at the end of this page runs the same test from your browser with several unique names at once. That way it also catches devices that query more than one resolver.
How to prevent DNS leaks
These steps work with any provider, and most of them are set once:
- Make the resolver part of the tunnel configuration. In WireGuard it is the
DNS =line in the[Interface]section, and its address must fall within what the tunnel carries. - Block port 53 outside the tunnel. A firewall rule that rejects any query not leaving through the tunnel interface closes most of the causes above at once, parallel queries included.
- Deal with IPv6. Either the tunnel carries it, or it is blocked on the device while the tunnel is up.
- With a proxy, let the proxy resolve. Use
socks5hor an HTTP proxy, and check the setting in each program separately. - Test again after every update. System and VPN client updates can put network settings back the way they were, so do not rely on an old result.
Encrypting DNS on its own does not stop a leak in this sense. It hides the query from the network in between, but the server that answers still knows the names and your address.
How syriaproxy handles DNS
In our apps and over WireGuard, name lookups travel inside the encrypted tunnel and are resolved inside Syria by Syriatel's resolvers. IPv6 is blocked inside the tunnel because the network is IPv4 only.
FAQ
Does a DNS leak reveal my real IP to the website?
Usually not directly. The site sees the recursive resolver's address, which points to your provider and your country. Your ISP and the resolver's operator, on the other hand, see the names together with your address.
Is it enough that sites use HTTPS?
No. The name lookup happens before the HTTPS connection and separately from it, so it stays exposed even when the page content is encrypted.
Does private browsing mode prevent leaks?
No. Private mode only avoids saving history and cookies on your device. It does not change how names are resolved or which path traffic takes.
The test shows a resolver in a different country from my IP. Is that a leak?
Not necessarily. Some tunnel operators use resolvers in another country, or anycast resolvers. It is a leak when the resolver belongs to your ISP or to the network you are really connecting from.
Test your connection now with the free DNS leak test.