Privacy
Find out which DNS resolvers your network actually uses. The test allocates a unique probe hostname under our authoritative zone and surfaces every resolver IP that hits our nameservers.
How the probe works
We hand your browser a random subdomain like a1b2c3.dnsleak.secdns.io. Your browser triggers a recursive lookup; whichever resolver hits our authoritative server is your real DNS exit. The result panel polls the API for any observations recorded against your token.
Run the leak test to populate this list.
Heads-up
The leak test relies on SecDNS’ authoritative wildcard zone forwarding query metadata to the public API. While that pipeline is rolling out, observations may be empty in some regions. The probe hostname itself is unique to your session and is rotated every 5 minutes.
A DNS leak happens when your device sends DNS queries through a different resolver than you expect — typically your ISP, instead of the encrypted resolver behind your VPN. Even if your IP is hidden, your ISP can still log every domain you visit if your DNS leaks.
We allocate a unique random subdomain under our authoritative wildcard zone and ask your browser to look it up. Whichever resolver answers is the resolver your network is actually using. Combined with our /v1/tools/dns-leak/observations API the page reveals every resolver IP that touched our authoritative servers in the last 5 minutes for your token.
Some VPNs only tunnel your traffic and let DNS use the system resolver. Others handle DNS but lose it on Wi-Fi switch or split-tunnel. macOS and Windows also fall back to the local DNS in some captive-portal flows. The leak test catches all of these cases.
Use a resolver that supports DoH or DoT (so the OS encrypts the query) and pin it system-wide. SecDNS provides DoH/DoT endpoints and per-device profiles that block queries unless they come through the encrypted channel.
In most cases yes. If your network forwards every external DNS query to a single internal resolver, the test will only see that resolver’s upstream egress IPs. That itself is a useful signal: nothing is leaking around your filter.