DNS Leak Test

Server assisted New Internet Security & Privacy

A full DNS leak test needs a test domain whose own name servers record which resolver asks for it; this page does not run one and says so. It shows the public address and network your browser's HTTPS traffic leaves from, as the Cloudflare edge sees it, and whether that network's name looks like a VPN, a data centre or an ordinary home or mobile line. Step-by-step instructions then show where to read the DNS resolver your system and browser really use.

Privacy: Your IP address and connection details are read from the request your own browser makes to the Mutqan server and shown back to you. They are not stored; a one-way hash of your address is used only for per-minute request limits.

What is a DNS leak and how can you check for one?

A DNS leak happens when, with a VPN on, the device's DNS queries go outside the tunnel to the internet provider's or the router's resolver, so that resolver still sees every name you look up. It is detected with a test domain whose name servers record which resolvers ask for unique names; without one, you can still read the resolver your system and your browser use and check that it belongs to the VPN.

How to use DNS Leak Test

  1. Connect your VPN (or leave it off to see your normal connection) and choose your answer to "Are you connected to a VPN or proxy right now?".
  2. Press Run the check. The page asks the Mutqan server once for the request it received from you.
  3. Read the network and its type: with a working VPN it should be the VPN provider or a data centre, not your home or mobile provider.
  4. Follow "Check your DNS resolver by hand" for your system to see where your DNS queries really go.

DNS Leak Test features

  • Shows the public IP address, its version, the network (AS organisation and number), country and city your browser's HTTPS traffic leaves from, as the Cloudflare edge sees it
  • Classifies that network from its name — VPN or proxy, hosting, residential, mobile or business — with the words that matched and a confidence level
  • Takes your answer to "Are you connected to a VPN or proxy right now?" and says whether the result fits it
  • Compares your browser's time zone with the time zone of the address
  • Step-by-step instructions to read the DNS resolver on Windows, macOS, Linux, Android, iPhone and iPad, and in the browser's own secure-DNS setting
  • Says plainly what it cannot see: the resolvers your DNS queries reach

Inputs and outputs

Inputs

  • Are you connected to a VPN or proxy right now? — Yes, No or Not sure. It only changes how the result is explained.
  • Your connection — the single request your browser makes to the Mutqan server when you press Run the check; nothing else is sent.

Outputs

  • Your connection — public IP address and version, network name and number, the location attached to the address, the Cloudflare edge that answered, and the address's time zone beside your browser's.
  • Network type — VPN or proxy, hosting, residential, mobile, business or unknown, with the confidence and the words that matched.
  • Reading — what the result means for the answer you chose.
  • Check your DNS resolver by hand — instructions for each system and for the browser.

DNS Leak Test example

A VPN that carries the browser's traffic

Input:

Are you connected to a VPN or proxy right now? Yes

Output:

Public IP address: 203.0.113.45 (IPv4)
Network (AS organisation): Example VPN Ltd · AS64500
Network type (from its name): VPN or proxy · high confidence — AS organisation mentions "vpn".
Reading: your browser's traffic leaves through a network that looks like a VPN, proxy or data centre — what a working tunnel looks like. This page cannot see your DNS resolver; use the steps below to confirm it belongs to the VPN too.

How to read the DNS Leak Test results

With a VPN on, the network should be the VPN provider or a hosting company. If it is your home or mobile provider, the VPN is not carrying this browser's traffic at all.

A network that looks like a VPN or a data centre while no VPN is on usually means a proxy, a browser extension, a corporate gateway, iCloud Private Relay or Cloudflare WARP is in the path.

"Unknown" means the network's name matched none of the known words. That is not a problem in itself; compare the address with the one your VPN app shows.

A browser time zone that differs from the address's time zone is normal with a VPN in another country, but it is one of the details websites can notice.

None of these lines says which DNS resolver answered you; only the manual steps can.

When to use DNS Leak Test

  • Checking that a VPN really carries your browser's traffic before you rely on it on public Wi-Fi.
  • Finding out whether a corporate proxy, a browser extension or a privacy relay changes the network websites see.
  • Walking a colleague through reading their DNS resolver when they suspect their VPN leaks.

Troubleshooting

  • The result shows your home provider although the VPN app says "connected" — look for split tunnelling or excluded apps in the VPN settings, turn off browser proxies and extensions, then run the check again.
  • A rate-limit or network message — wait a moment and press Run the check again; the page needs one request to the Mutqan server.
  • Your system shows your router (often 192.168.x.1) as the DNS server — the router forwards to the provider's resolver. Check the router's DNS settings, or the VPN's own DNS option.
  • The browser has "secure DNS" set to a provider — that provider receives the browser's lookups instead of the system resolver. That is not a leak if you chose it, but it bypasses the VPN's DNS unless the VPN carries that traffic too.

Frequently asked questions about DNS Leak Test

Can this page see which DNS resolver I use?

No, and it does not pretend to. A web page cannot read the resolver your system uses; a website sees resolvers only through a test domain whose name servers log who asks for unique names — infrastructure this site does not run. The page shows the network your traffic leaves from and gives the exact steps to read your resolver yourself.

What is a DNS leak?

With a VPN on, your DNS queries should travel through the tunnel to the VPN's resolver. A leak is when they go outside it — to your internet provider's or your router's resolver — so that provider still sees every site you look up even though the rest of your traffic is tunnelled.

My VPN is on, but the result shows my home provider. What does that mean?

That the VPN is not carrying this browser's traffic at all, which exposes more than a DNS leak would. Check that the VPN is connected, that split tunnelling does not exclude the browser, and that no browser proxy or extension routes around it, then run the check again.

How is the network type decided?

From the name of the network that owns the address (its AS organisation), matched against VPN brands, hosting providers, mobile carriers and internet-provider vocabulary. It is a keyword match on a name, not a database of VPN exits: a VPN that rents residential addresses looks residential, and the confidence level says how strong the match is.

Is my IP address stored?

No. It is read from the request your browser makes to the Mutqan server when you press Run the check, shown back to you and not stored. Nothing is sent to any other service.

Technical notes

The address, AS number and AS organisation come from your own request as the Cloudflare edge received it (GET /api/v1/internet/me); nothing is looked up elsewhere. The network type is a keyword match of the AS organisation name against VPN brands, hosting providers, mobile carriers and internet-provider vocabulary.

A DNS leak test proper needs authoritative name servers for a test zone: the page makes the browser resolve unique random names and the zone's servers log which resolver addresses ask. This site runs no such zone, so it cannot list your resolvers. Why DNS queries reveal browsing is described in RFC 9076 (DNS Privacy Considerations).

Encrypted DNS changes who sees the queries, not whether they leave the tunnel: a browser using DNS over HTTPS (RFC 8484) sends its lookups to the provider chosen in the browser, and a system using DNS over TLS (RFC 7858) to the provider chosen in the system, so both settings must be checked.

Limitations and methodology

This is a limited diagnostic: it cannot see which DNS resolvers your queries reach, because that needs a test domain with its own name servers, which this site does not run.

The network type is a keyword match on the AS organisation name: VPNs that rent residential addresses look residential, and many networks mix kinds.

The address and network are those the Cloudflare edge saw for this one request; other apps on the same device may take a different route.

Security and privacy

Pressing Run the check sends one request to the Mutqan server, which reads your IP address and the network details Cloudflare attaches to it and shows them back to you. Nothing is stored, and nothing is sent to any other service.

References