Tools / DNS Leak Test
DNS Leak Test
You think
"The VPN encrypts everything."
The mirror
Your DNS queries — every domain you type — may still go to your ISP. The tunnel has a side door.
This test triggers DNS lookups to subdomains we control. Our DNS server records which resolver IPs queried it — these are infrastructure IPs (e.g. Google's 74.125.x.x, your ISP's DNS server), not your personal IP. Resolver data is deleted after one hour. On your device we keep only the verdict, so a re-run can show "Fixed ✓".
What this means for you
Every domain you open starts with a DNS lookup. Whoever answers it sees the list of sites you visit — this test shows who that is.
It happened
The Silk Road hidden service ran on Tor for more than two years. According to the FBI, it was found because the server's real IP leaked through a misconfigured login page — not because Tor was broken. The same pattern applies to DNS: the tunnel works, but the queries go around it.
Synthesis
Resize this reflection — free first
Check your VPN's DNS settings
Most VPNs have a "DNS leak protection" or "Use VPN DNS" toggle. Enable it. On macOS/Linux, check /etc/resolv.conf — if it shows your ISP's DNS, your VPN isn't handling DNS.
Use a privacy-respecting public DNS
If you don't use a VPN: switch from your ISP's DNS to a public resolver. This stops your ISP's resolver from logging your queries.
Fixed it? Prove it.
Re-run the test — a clean result flips this finding to green. Your "Fixed ✓" state is kept on this device only.
What is a DNS leak?
DNS is the internet's phonebook. Before your browser can open a site, it asks a DNS resolver "what is the address of example.com?" — so whoever runs that resolver gets a list of every domain you visit, with timestamps.
A VPN should send those lookups through its tunnel to its own resolver, so your ISP sees only encrypted traffic to the VPN server. In a DNS leak, the lookups go around the tunnel to your ISP's resolver instead — the VPN is on, but your ISP still sees every domain.
This test makes your browser look up a handful of unique, random names under a domain we control. Your resolver has to ask our DNS server for each one, and our server notes which resolver asked. If that resolver belongs to your ISP while you are on a VPN, your DNS is leaking.
The images the test loads never appear and are not meant to: only the lookup matters. If you run your own resolver at home (for example Pi-hole with unbound), the resolver address the test sees is your home connection.
Checked DNS? Hold the mirror up to the next belief
Full Digital Mirror scan
You think: one leak, one problem.
The mirror: all findings in one reflection, scored.
WebRTC Leak Test
You think: the VPN covers everything.
The mirror: WebRTC can hand out your real IP anyway.
Email Breach Check
You think: my inbox is mine.
The mirror: the average address sits in several public dumps.