What Is a DNS Leak?
what is a dns leak: clear guide, checks, and next steps.
Quick answer
A DNS leak question should become a resolver comparison: run the DNS Leak Test before and after VPN or secure-DNS changes, then save a reduced Privacy Receipt if you need to share the result.
Article to tool flow
DNS results can differ because of ISP DNS, router DNS, browser Secure DNS, public resolvers, VPN DNS, or geolocation mismatch.
A Privacy Receipt is a reduced, share-safe diagnostic summary. It removes raw IP addresses, exact city, full User-Agent, resolver IPs, and WebRTC candidates. It is not proof of anonymity, a VPN provider audit, or a security certificate.
Summary FAQ
What should I do after reading this article?
Run the linked DNS Leak Test first, then compare one related tool if the result does not match what you expected.
What should I save or share?
Use the Privacy Receipt when you need a safe summary. Avoid posting raw IPs, exact location, full User-Agent, resolver IPs, or WebRTC candidate strings publicly.
Does a clean-looking result mean everything is private?
No. MyIPScan checks visible browser/session signals in this context. It helps you find review items, but it does not certify a VPN, device, provider, account, or network.
DNS leak checks compare the visible resolver route with the privacy setup you expected.
| Signal | What it can show | How to read it |
|---|---|---|
| Resolver owner | The DNS service answering lookups | Mismatch can be expected with VPN, encrypted DNS, or network policy. |
| Resolver location | Approximate route of the DNS resolver | Use it as a clue, not proof of physical location. |
| IP route | Whether the visible IP and DNS route tell the same story | A mismatch needs context before calling it a leak. |
What a DNS Leak Means
DNS is the lookup process that helps turn a domain name into an address a device can use. A DNS leak concern appears when the resolver path visible to a test does not match the VPN or privacy setup the user expected.
That does not mean every unexpected resolver is malicious or harmful. Some browsers, operating systems, VPN clients, enterprise policies, and encrypted DNS settings can change which resolver appears. The right interpretation depends on context.
A DNS leak article should stay separate from general DNS Lookup content. DNS Lookup explains public records. A DNS leak test explains whether the visible resolver signal deserves review.
For broader VPN context, read What Is a VPN Leak? instead of treating DNS as the whole VPN result.
What MyIPScan Checks
Use the DNS Leak Test to check visible resolver signals from the current browser/session context.
If you are testing a VPN setup, run the VPN Leak Test first, then use the DNS test for focused resolver review. WebRTC and IPv6 can still behave differently, so compare with the WebRTC Leak Test and IPv6 Leak Test.
The methodology explains why DNS results are limited resolver signals and not a full capture of every DNS request made by the device.
How to Interpret the Result
A clear DNS result means MyIPScan did not observe a resolver review flag in the checked flow. A review-needed result means the visible resolver signal may not match what you expected and deserves closer inspection.
Mixed, unavailable, or unknown DNS signals should lower confidence. Unknown is not the same as safe, and it is not automatically a failure. It means the test had less information.
What the Result Cannot Prove
A DNS leak test cannot prove every DNS request from the device used the same resolver. Browser tests usually see selected paths, not every application and network layer.
A clean DNS result does not prove anonymity or every leak condition. It only describes the checked resolver signal in this current browser/session context.
What to Do Next
If DNS needs review, compare the result before and after connecting the VPN. Check VPN DNS settings, browser secure DNS settings, operating-system resolver settings, and network policy. Change one setting at a time and retest.
The Privacy Receipt can summarize DNS as a safe category, such as clear, review, mixed, or unknown. It should not export raw resolver IPs or other sensitive diagnostic identifiers.
Next Step: Run the Related MyIPScan Checks
Check it on MyIPScan: run the primary diagnostic for the current browser session.
- Primary check: DNS Leak Test
- Related check: VPN Leak Test
- Related check: WebRTC Leak Test
- Related check: DNS Lookup
- Methodology: read MyIPScan Methodology v1.1
FAQ
What is a DNS leak?
A DNS leak is a visible resolver or route signal that may not match the DNS path you expected for the current browser session.
Does a clean DNS result prove every DNS leak is absent?
No. It means the checked resolver signal did not show a review flag. It is not authoritative DNS capture.
How do I verify a DNS leak?
Run the DNS Leak Test before and after VPN or resolver changes, then compare the visible resolver category.
How is a DNS leak different from a VPN leak?
A DNS leak is one possible VPN leak signal. A VPN leak test also reviews IP, WebRTC, IPv6, and browser/session signals.
What should I do when DNS review is needed?
Check VPN DNS settings, browser secure DNS settings, OS resolver settings, and network policy, then retest.