DNS Leak Test: Find Out If Your VPN Is Really Protecting You

CodexFuse Team · 2026-10-28T15:24:28.077Z · 9 min read min read

Run a free DNS leak test to see whether your lookups bypass your VPN — and fix the leak in minutes.

A dns leak test checks whether your DNS requests — the lookups that turn domain names like example.com into IP addresses — are travelling through your VPN or quietly going to your internet provider instead. If they go to your provider, that provider can see which sites you visit even while your VPN appears connected. That gap is called a DNS leak, and it defeats much of the privacy a VPN is supposed to give you.

CodexFuse offers a free DNS leak test you can run in your browser. It takes a test label, runs a simulated check, and shows you whether your setup looks clean or needs attention. This guide explains what the results mean, why leaks happen, and what to do when one shows up.

What Is a DNS Leak, Exactly?

A DNS leak happens when your device sends domain-name lookups to a DNS resolver outside your VPN tunnel, usually your internet provider's resolver, while your other traffic stays inside the tunnel. Your VPN may still encrypt your page content, but the list of domains you look up can leak to a party you were trying to keep out of the picture.

Important

A leak does not mean your VPN is useless. It means one specific part of your setup — name resolution — is bypassing the tunnel. That is fixable, usually by changing one setting rather than replacing your whole setup.

How Do You Run a DNS Leak Test?

To run a dns leak test, connect your VPN first, open the test tool, enter a test label, and run the check. Then compare the DNS resolvers shown in the result with your VPN provider's resolvers: if you see your internet provider or an unexpected third party, you have a leak to fix.

Here is the walkthrough on the CodexFuse tool:

Connect your VPN first. The test only judges the setup active when you run it.
Open the DNS leak test. Go to the free DNS leak test tool in the browser and network you want to check.
Enter a test label. Type a short label, such as "home-wifi-check", to identify the run.
Run the simulated test. Start the check and wait for the result instead of switching networks halfway through.
Read the resolvers, not just the verdict. Note every resolver and which organisation owns it.

Note: the tool asks you to log in, so create a free account first if you do not have one.

A Worked Example: One Remote Worker, One Surprising Result

Consider a fictional scenario. Maya is a freelance graphic designer who works from a home office and a coworking space. She uses a VPN on her laptop and assumes her browsing is private on both networks.

On a Tuesday morning, she connects her VPN at the coworking space, opens the DNS leak test, and enters the test label "maya-coworking-tue". She runs the simulated check. The result lists two resolvers: one belonging to her VPN provider and one belonging to the coworking space's internet provider.

That second resolver is the problem: some lookups bypass the tunnel, so the coworking provider can see the domains she visits even though page content stays encrypted. Her fix takes about ten minutes — enable the VPN app's "block traffic outside the tunnel" setting, switch to VPN-only DNS, and re-run the test as "maya-coworking-tue-retest". This time only the VPN provider's resolver appears.

The lesson: a default setting on one network quietly routed DNS around her VPN, and only a test caught it.

What Do the Results Mean?

Results are easier to read when you sort them into three buckets:

What you see	What it means	What to do
Only your VPN provider's resolvers	Your DNS is staying inside the tunnel for this check	Re-test after network or app changes
Your internet provider's resolver appears	Some lookups bypass the tunnel	Force VPN-only DNS and re-test
An unfamiliar third-party resolver appears	Another resolver is handling your lookups	Find which app or network set it, then change it

One unexpected entry is enough to count as a leak. If you are unsure who owns a resolver, search its IP address before dismissing it.

Why Do DNS Leaks Happen?

Default provider DNS wins. Devices keep using the network's DNS unless the VPN app overrides it.
Split tunnelling splits DNS too. Apps routed outside the VPN take their lookups with them.
IPv6 takes a different road. Some setups protect IPv4 but leave IPv6 lookups exposed.
Network changes reset settings. A new Wi-Fi network can silently restore its own DNS.
Browser features add lookups. Built-in DNS features can bypass your system settings, so test in the browser you use.

Pro Tip

Test on every network you use for sensitive work, not just your home connection. Maya's leak only appeared at the coworking space, and a home-only test would have missed it completely.

DNS hygiene sits alongside other small checks that protect a site or a business. If you run a website, it is worth pairing this test with a SPF record check for your mail, a DKIM record check, and a DMARC record check so your domain's DNS records are as clean as your browsing setup.

Your VPN Should Hide More Than Your IP Address

If a leak test shows your provider seeing your lookups, your privacy setup has a hole that a managed platform can help you close — CodexFuse handles your hosting, email and security for you, on pay-as-you-go credits, so you stop babysitting DNS settings yourself.

Get Started with CodexFuse

How Do You Fix a DNS Leak?

To fix a DNS leak, force all DNS through your VPN provider: enable your VPN app's kill switch or leak-protection setting, set the app to use only the provider's DNS, disable IPv6 or route it through the tunnel, and then re-run the test to confirm that only the provider's resolvers appear.

Work through these steps in order:

Turn on leak protection. Enable the kill switch and any "block traffic outside the tunnel" setting.
Set VPN-only DNS. Switch from automatic DNS to the provider's own resolvers.
Close the IPv6 gap. Disable IPv6 or confirm your VPN routes it through the tunnel.
Check the browser separately. Turn off browser DNS features that bypass system settings.
Re-run the test. Use a new label like "retest-after-fix" and confirm only VPN resolvers appear.

If the leak survives all five steps, the cause is usually network-level — a router or corporate network forcing its own DNS — and you should treat that network as untrusted for sensitive work.

What This Tool Does Not Do

Honest limits matter here, because a screening tool is not a forensic audit. Keep these in mind:

It runs a simulated check. Treat its result as a screening signal, not proof about every packet on your network.
It does not test every device at once. A clean laptop result says nothing about your phone or tablet.
It does not audit your VPN provider. It cannot verify whether your provider logs queries.
It does not replace a full network test. Confirm suspicious results with your provider's own test before drawing conclusions.

Suggested Reading

If you want to tighten the rest of your setup, read our guide to checking your site's security headers and our browser fingerprint checker walkthrough — DNS is one layer, and the other layers matter too.

Moving Your DNS and Hosting to Managed Care

For a business, the deeper problem is rarely one setting. DNS, hosting, email, and security are scattered across providers, and nobody owns the whole picture.

On CodexFuse, the workflow is concrete: create an account, add pay-as-you-go credits with no subscription, and move your hosting and business email onto the platform. Your site, mail, and security then live in one managed place, with one support team that can see the whole setup when a record drifts.

Decision rule: one personal device means fix the setting and re-test. A business site, client email, or small team means consolidate — one managed platform, one set of DNS records, one team keeping them correct.

Frequently Asked Questions

Is a DNS leak test free?

Yes — free and unlimited, though you need a free account to log in to the tool.

Do I need a VPN to run a DNS leak test?

Yes, if you want to test VPN protection. Without a VPN there is no tunnel, so the test simply shows your provider's resolvers.

How often should I test for DNS leaks?

Whenever your setup changes — new app version, network, device, or split-tunnelling setting. Monthly re-tests are a sensible habit.

Can a DNS leak expose my passwords?

Not directly. It exposes which domains you visit, which enables profiling — someone who sees your lookups learns a great deal without reading your traffic.

Why does the tool ask for a test label?

It identifies your run so you can compare results over time — use labels like "home-retest" to see which run fixed the problem.

What should I do if the leak will not go away?

Work through the fix steps, then test on a different network. If the leak follows you everywhere, contact your VPN provider with your test labels and results.

Stop Guessing About Your Privacy — Check It Today

Your VPN is only as private as its weakest setting, and DNS is where that weakness usually hides. Run the DNS leak test now, with your VPN connected, and read the resolvers yourself instead of assuming the tunnel is sealed.

If the result shows a leak, fix the setting and re-test until it is clean. And if you are tired of babysitting DNS, hosting, and email across scattered providers, move them to CodexFuse today: sign up, add credits, migrate your hosting and business email to one fully managed platform, and let one team keep the whole setup correct — no subscriptions, no lock-ins, no more guessing.