DNS diagnostics

DNS Leak Test

Learn how to test DNS leaks after connecting to a VPN, proxy, V2Ray node, or Clash subscription, and how to fix resolver mismatches.

Updated: 2026-05-11

Open NetScope

Direct Answer

A DNS leak means DNS queries may still go to an unexpected resolver, often the original ISP or browser secure DNS provider. Check it after every VPN or proxy change.

What to compare

Compare public IP location, DNS resolver owner, DNS country, and whether the DNS path matches the VPN or proxy route.

Common causes

Browser secure DNS, Android private DNS, split tunneling, rule mode, and local network settings can all change resolver behavior.

How to fix

Use VPN DNS settings, test global mode, disable conflicting secure DNS settings, and retest after each change.

Steps

Connect to the VPN, proxy, or node.
Run a browser-side DNS test.
Compare DNS resolver country and provider with the expected route.
Change DNS or route settings and test again.

Checklist

DNS resolver is not the original ISP.
Browser secure DNS is not overriding the route.
Rule mode and global mode have been tested separately.
Mobile private DNS is not causing a mismatch.

Troubleshooting

DNS shows the original ISP

Enable VPN DNS or global mode and disable browser secure DNS for the test.

DNS country differs from VPN country

This may be normal for some providers, but compare multiple nodes and check for ISP exposure.

Only one browser leaks

Check that browser secure DNS or extensions are not overriding system settings.

WebRTC leak test Check browser-level exposure next. VPN DNS leak test Broader privacy diagnostics guide. Clash setup Fix routing and DNS rules. VPN free trial Compare stable VPN options.

FAQ

Is every DNS mismatch a leak?

No. Some VPN providers use third-party resolvers. The key risk is DNS going to the original network or an unexpected resolver.

Can browser secure DNS cause leaks?

Yes. Browser-level secure DNS can bypass the expected system or VPN resolver.

Should I test in global mode?

Yes. Global mode helps separate node failure from rule or split-tunnel behavior.