Why does the browser request fail?

The test hostname is DNS-only. Its deliberate failed image request causes your browser to resolve the unique hostname; there is no web content to load.

Does this expose my DNS query to a third party?

The unique hostname travels through your normal resolver path to this test zone. The page only calls same-origin APIs and does not share token or resolver data with third parties.

Why might I see a DoH or DoT provider?

Encrypted DNS correctly sends the lookup through its provider, so that provider can appear instead of your ISP resolver.

DNS Leak Test

Generate a unique test hostname, make this browser resolve it, then see the DNS resolver addresses our authoritative service observed.

The one-time hostname is sent only to its DNS path and this site. We do not send your token or resolver addresses to third parties.

Run the test

Start creates an opaque token, then this page deliberately loads a DNS-only hostname. The web request is expected to fail after DNS resolution; polling continues safely.

Observed DNS resolvers

Each row is an address that reached the authoritative test zone. A resolver may be your encrypted DNS provider or a shared upstream resolver, not necessarily your ISP.

How to interpret the result

Run the test while your VPN is connected
Use the same browser and connection you want to check.
Review the resolver rows
Compare the observed providers with the DNS service you expect your VPN or network to use.
Treat no row as an inconclusive test
A blocked request, cached lookup, extension, or network policy can prevent observation. It is not proof that no leak exists.

Frequently asked questions

Why does the browser request fail?: The test hostname is DNS-only. Its deliberate failed image request causes your browser to resolve the unique hostname; there is no web content to load.
Does this expose my DNS query to a third party?: The unique hostname travels through your normal resolver path to this test zone. The page only calls same-origin APIs and does not share token or resolver data with third parties.
Why might I see a DoH or DoT provider?: Encrypted DNS correctly sends the lookup through its provider, so that provider can appear instead of your ISP resolver.