The DNS Leak Check page checks resolver exposure through an administrator-owned authoritative observer. It is deliberately unable to claim that there is no leak unless the administrator has configured a trusted resolver comparison list.
Run A DNS Leak Check
- Open DNS Leak Check.
- Select Start DNS Check.
- Keep the page open while the browser requests the temporary test hostname and the observer reports the result.
- Read the assessment first, then review each observed resolver address.
What The Observer Sees
The browser resolves one randomized child hostname below the configured probe domain. The authoritative observer records resolver addresses that reach it for that test. The application calls only its fixed HTTPS observer API; a visitor cannot supply an observer URL, probe domain, or remote destination.
Understand Results
- Inconclusive means resolver addresses were observed but no trusted allowlist is configured, or the network did not provide a comparable observation.
- Matched means every observed resolver is in the administrator-approved list.
- Potential leak means one or more observed resolvers are outside that list. Check VPN, browser secure-DNS settings, the network resolver, and the administrator list before drawing a conclusion.
Privacy And Limits
The test causes one DNS lookup. This application does not receive your DNS settings or collect a browser resolver configuration. Caches, split DNS, encrypted DNS, VPN policy, resolver forwarding, and the observer deployment can alter what is seen. A matched result describes this one test, not every application on the device.
Troubleshooting
- Observation not configured: the administrator must configure a public delegated probe domain, a fixed HTTPS observer, and its secret in DNS And WebRTC Leak Config.
- Observer unavailable or timeout: wait briefly, then retry; the browser cannot replace the observer with another target.
- Unexpected resolver: record the address, verify whether a VPN or secure-DNS service is active, and compare the configured allowlist with the intended policy.
- Address exposure concern: run WebRTC Leak Check separately because DNS and WebRTC test different browser paths.
Icon Reference
| Icon | Label | What It Does |
|---|---|---|
| Start DNS Check | Starts the temporary DNS observation through the configured authoritative observer. | |
| Copy Address | Copies one observed resolver address without changing the result. | |
| Open Help | Opens this DNS Leak Check guide from the tool panel. |