A guide to DNS leak testing
Your web traffic uses a VPN. Does name resolution follow the route you intended? Start with the resolvers actually observed.
What is a DNS leak?
DNS translates domain names into network addresses. A DNS leak usually means a lookup uses an unintended resolver, such as an access provider’s DNS, when you expected a VPN or a chosen DNS service to handle it.
A web exit and a DNS resolver have different jobs. Their IP addresses and countries do not have to match. Seeing a public service such as Google or Cloudflare is not, by itself, proof of either a leak or a VPN-protected path.
Compare the observed route with your intended configuration.
What do the DNS results mean?
The labels use resolver organizations and exit-network signals. The browser cannot inspect your VPN tunnel or operating-system DNS configuration.
- Possible DNS leak
- The exit has a VPN, proxy or Tor signal while an access-provider-type resolver is observed. Review DNS handling and split tunneling. This is a lead to investigate, not direct inspection of traffic inside the tunnel.
- No obvious leak found
- Observed resolvers match recognized public DNS organizations without triggering the access-provider rule. Confirm that those services are intended. This does not establish that every DNS request passed through a VPN.
- Unverified
- Resolver ownership or route evidence is insufficient. Private resolvers, enterprise forwarders and organizations outside the identification rules can produce this result.
- No queries observed
- The test received no usable resolver observation. Network restrictions, failed lookups or an unavailable test service can cause this. No record is not proof of no leak.
Four steps to review your DNS path
Establish the intended configuration first. Change one setting at a time so the comparison remains useful.
Identify the intended service
Review DNS settings in the VPN, router, operating system and browser. A browser’s secure DNS feature may deliberately use a separate provider.
Compare before and after
Where appropriate, compare the resolver organizations and web exit with the VPN disconnected and connected. Do not rely only on country flags: one service can use several IPs and locations.
Review DNS and split tunneling
Check the VPN’s DNS protection, IPv6 and split-tunnel settings. An extension that proxies web requests may not control operating-system or other application lookups.
Retest and cross-check
Run the test again after changes, then check WebRTC separately. On managed networks, follow the administrator’s policy rather than disabling secure DNS simply to change a label.
How does CHA.LA run this check?
The page creates a short-lived DNS test session, requests session-specific names and reads the recursive resolver addresses recorded by the observation service. Those addresses identify the resolvers querying the service, not necessarily the address shown in your device settings.
Rules then compare resolver organization names with VPN, proxy and Tor signals for the current exit. An ordinary PTR, CNAME or domain-record lookup cannot replace this connection-specific observation.
Frequently asked questions
Public DNS, VPN routing, encrypted DNS and differences between results.
Does Google or Cloudflare DNS indicate a leak?
Not necessarily. VPNs, browser secure DNS and routers may intentionally use a public resolver. The important questions are whether that choice is intended and whether the request follows your chosen route. A provider name cannot reveal the entire connection path.
Can DNS be in a different country from my VPN?
Yes. Anycast, forwarding and separate egress points can produce different locations, and IP geolocation can be inaccurate. Review the organization, provider documentation and changes between tests instead of treating a country mismatch as proof of a leak.
Why are several resolvers listed?
Load balancing, multiple upstreams, IPv4/IPv6 and forwarding can produce several query sources during one test. The count is not a risk score. Check whether each source belongs to the service you intended to use.
Does DoH or DoT guarantee that DNS cannot leak?
No. They encrypt a connection segment to a DNS service. Which provider handles the lookup, whether the connection goes through a VPN, and whether other applications share that setting are separate questions.
Why are resolvers visible in private browsing?
Private browsing mainly changes local history, cookies and session storage behavior. It does not inherently reroute DNS or every network connection, so query sources can still be observed.
How is this different from a DNS lookup tool?
A DNS lookup tool asks for records such as CNAME or PTR. This test uses session-specific names to observe which resolvers handle the current connection’s lookups. One checks a record; the other observes a query source.