DNS Leak Test

Every time you open a site, your browser asks a DNS resolver for its IP address. On a VPN, that question should go through the tunnel to the VPN's resolver. A DNS leak is when it goes to your ISP's resolver outside the tunnel instead: the ISP still learns which sites you visit, even though the traffic itself is encrypted.

Your browser resolves a few one-off names under leak.ipku.in, like a1b2c3d4e5f6-1.leak.ipku.in. Only the ipku.in nameserver can answer them, so whichever resolver asks for them is the one your connection uses. That resolver's address is then compared with your IP: same network, a public resolver, or another network.

Not if you're not on a VPN: that's the resolver your ISP hands out. A leak is when you are on a VPN and your ISP's resolver still shows up here. On a VPN, seeing the VPN's own network or a public resolver means your DNS is fine.

Some ISPs redirect every DNS query on port 53 to their own resolvers (a transparent DNS proxy), usually for content filtering. DNS settings on your router or computer make no difference. Encrypted DNS gets around it: DNS over HTTPS (DoH) or DNS over TLS (DoT), found in Chrome's and Firefox's Secure DNS setting, Android's Private DNS, and the 1.1.1.1 app.

Turn on DNS leak protection in your VPN app (most have it), or set your computer to use the VPN's resolver. On Windows, disable Smart Multi-Homed Name Resolution. In the browser, Secure DNS (DNS over HTTPS) forces DNS over HTTPS to the resolver you pick, so it can't leak to the ISP. Run this test again after changing anything.

Yes. curl ipku.in/en/tools/dns-leak-test starts a test and prints the command to resolve its names; then curl 'ipku.in/en/tools/dns-leak-test?token=…' prints the result as plain text, and /api/dns-leak/<token> as JSON.