DNS Leak Checker
Running live test…

Test My DNS – Check Your DNS Server, Speed & Security

Your DNS configuration affects three things that most users never check: how fast websites load, whether your browsing activity is visible to your ISP, and whether your DNS responses are cryptographically verified against tampering. Most people use whatever DNS server their ISP assigned by default and have never tested whether it is fast, private, or secure. This tool runs four DNS checks simultaneously to give you a complete picture of your current DNS health in one place. Run the test above and see exactly where you stand.

Improve DNS SpeedFix a DNS LeakSwitch to CloudflareCheck DNSSEC

What Does a DNS Test Check?

A DNS test can check several different aspects of your DNS configuration depending on what you are trying to diagnose. The most common reason people run a DNS test is to check for DNS leaks — a situation where a VPN is active but DNS queries are still being routed through the ISP rather than through the VPN's private servers. This is the test on the homepage of this site and it is the most privacy-critical DNS check for VPN users.

A DNS server identification test tells you exactly which DNS server your device is using right now. This is useful for confirming that a DNS change you made has taken effect, verifying that your VPN is routing DNS correctly, or simply finding out who is handling your DNS queries. The result reveals the IP address of your DNS server and often the name of the provider operating it.

A DNS speed test measures how long your current DNS server takes to respond to queries. DNS response time is one component of overall website loading time — a slow DNS server adds a consistent delay to every new domain you visit. A speed test can confirm whether your current DNS is performing well or whether switching to a faster provider like Cloudflare 1.1.1.1 would improve your browsing experience.

A DNSSEC test checks whether your DNS resolver validates cryptographic signatures on DNS records. DNSSEC protects against DNS cache poisoning and spoofing attacks that can silently redirect you to malicious websites. Most ISP DNS servers do not validate DNSSEC. Public DNS providers like Cloudflare, Google, and Quad9 all support DNSSEC validation, providing protection that typical ISP DNS does not.

Running all four tests together — server identification, leak detection, speed measurement, and DNSSEC validation — gives you a comprehensive view of your DNS security posture. The tool at the top of this page runs all four automatically. Each individual test is also available as a dedicated tool on this site for deeper investigation of specific issues.

What Your DNS Test Results Mean

If you are a VPN user and all four panels show green — private DNS provider detected, no DNS leak, fast response time, and DNSSEC validated — your DNS configuration is optimal. Your VPN is correctly routing DNS through its own private servers, the servers are responding quickly, and DNSSEC validation is protecting you against DNS spoofing. This is the ideal state for any privacy-conscious user and indicates no further action is needed.

If the DNS server panel shows your ISP's name while you believe your VPN is connected, you have a DNS leak. This is the most critical finding because it means your ISP can see every domain you visit despite your VPN encrypting your other traffic. The leak may be caused by your VPN's DNS settings, Windows Smart Multi-Homed Name Resolution, or a recent VPN update that changed your configuration. Fix this immediately using the DNS leak fix guide.

If you are not using a VPN and the test shows your ISP's DNS server, this is expected behaviour — it simply means your DNS queries are going to your ISP's default server. While this is not a "leak" in the VPN sense, it does mean your ISP has full visibility into your browsing activity at the DNS level. Consider switching to a privacy-focused DNS like Cloudflare 1.1.1.1 for improved privacy even without a VPN.

If your speed shows as "Slow" (over 50ms) regardless of provider, your DNS is adding noticeable delay to your browsing. Visit the DNS Speed Test to compare your current DNS against Cloudflare, Google, and other providers to find the fastest option for your location. If DNSSEC shows as "Not Validated," switching to any major public DNS provider (Cloudflare, Google, or Quad9) will enable DNSSEC validation automatically.

How to Fix Common DNS Problems

Fixing a DNS Leak

A DNS leak requires fixing your VPN's DNS routing configuration. Start by enabling your VPN's built-in DNS leak protection setting if it has one — most premium VPNs include this option in their settings panel. On Windows, disable Smart Multi-Homed Name Resolution which can cause DNS queries to bypass the VPN. After making changes, return to the DNS leak test or the VPN leak test to verify the fix. If the leak persists, try switching your VPN protocol from UDP to TCP or reinstalling the VPN client.

Switching to a Faster DNS Server

If your DNS response time is slow, switching to a faster provider is straightforward and takes under two minutes on any device. Use the DNS Speed Test to identify which provider is fastest for your specific location — Cloudflare (1.1.1.1) is fastest for most users globally, followed by Google (8.8.8.8). The Cloudflare DNS Test page includes step-by-step setup instructions for every platform. Change DNS at your router level to apply faster DNS to all devices on your network automatically.

Enabling DNSSEC Validation

DNSSEC validation is a feature of the DNS resolver, not something you configure on your device. To enable DNSSEC validation, simply switch to a DNS provider that supports it — Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9) all validate DNSSEC by default. Once you switch, all DNS responses will be cryptographically verified before being returned to your device, protecting you against cache poisoning and DNS spoofing attacks. No additional configuration is needed beyond the DNS server change itself.

Using a VPN for Complete DNS Privacy

A VPN provides the most comprehensive DNS privacy solution by routing all DNS queries through an encrypted tunnel to the VPN provider's private DNS servers. This prevents your ISP from seeing your DNS queries, hides your IP from DNS providers, and eliminates the possibility of DNS interception on public Wi-Fi or compromised networks. NordVPN includes private DNS on every server with a strict no-logging policy, making it one of the strongest options for DNS privacy. Combined with browser-level settings for WebRTC protection, a VPN addresses every vulnerability this test can detect.

DNS Testing for VPN Users — What to Check

If you use a VPN, the most critical test is the DNS leak check. Your VPN should be routing all DNS queries through its own private servers — if your ISP's DNS appears instead, you have a leak that undermines a core function of your VPN. Run the DNS leak test first and fix any leaks before checking other DNS metrics, because a DNS leak makes speed and DNSSEC results less relevant (you would be optimising a configuration that is already compromising your privacy).

Once you have confirmed no DNS leak, check the speed of your VPN's DNS servers. VPN DNS servers can sometimes be slower than direct public DNS like Cloudflare because queries travel through the VPN tunnel to the VPN server's location before being resolved. This is a normal trade-off for privacy — the added latency is typically 10–30ms and is acceptable for most users. If your VPN DNS is significantly slow (over 80ms), try switching to a VPN server closer to your physical location.

Finally, verify DNSSEC support on your VPN's DNS servers. Most premium VPN providers including NordVPN, ExpressVPN, and Surfshark validate DNSSEC on their private DNS servers. If your VPN's DNS does not support DNSSEC, it is not a critical issue — the VPN's encryption already protects against the network-level attacks that DNSSEC addresses — but it is an indicator of the VPN provider's commitment to DNS security best practices.

We may earn a commission if you purchase through our link

Yes, a properly configured VPN overrides your device's DNS settings and routes all DNS queries through the VPN provider's own private DNS servers. This means your DNS server changes from your ISP's DNS (or whatever you have configured) to your VPN's DNS when the VPN connects, and reverts back to your original DNS when the VPN disconnects. This DNS switching is intentional and is a key part of how VPNs protect your privacy — it prevents your ISP from logging your DNS queries while the VPN is active. If your DNS does not change when you connect your VPN, you likely have a DNS leak that needs to be fixed.

Frequently asked questions

How do I test my DNS server?

The easiest way to test your DNS server is to use the tool at the top of this page, which runs four DNS tests simultaneously: server identification, leak detection, speed measurement, and DNSSEC validation. It runs automatically when the page loads — no software installation, account creation, or configuration is required. The test works by making DNS queries from your browser and analysing the responses to determine which DNS server is handling your requests, how fast it responds, whether it is leaking queries outside your VPN, and whether it validates DNSSEC signatures. You can re-run the test at any time by clicking the Re-run All Tests button.

What should I look for in a DNS test result?

A good DNS test result shows four green indicators: your DNS server is a private provider (not your ISP), no DNS leak is detected, response time is under 20 milliseconds, and DNSSEC validation is active. If any of these are yellow or red, the corresponding section explains what the issue is and how to fix it. The most critical check for VPN users is the leak detection panel — if it shows a leak, your VPN is not properly routing your DNS queries and your ISP can see your browsing activity. Speed and DNSSEC are important but secondary to the privacy implications of a DNS leak.

What does it mean if my DNS test shows a leak?

A DNS leak means your DNS queries are being sent to your ISP's DNS servers rather than through your VPN's encrypted tunnel. This exposes every domain you visit to your ISP even though your VPN is encrypting your other traffic and masking your IP address. DNS leaks are common on Windows due to the Smart Multi-Homed Name Resolution feature and can occur on any platform after VPN updates or network changes. To fix a DNS leak, check your VPN's DNS settings, enable the VPN's built-in DNS leak protection if available, and run the test again to confirm the fix.

How do I know if my DNS is fast enough?

A DNS response time under 20 milliseconds is considered fast and will not cause any noticeable delay in your browsing experience. Response times between 20 and 50 milliseconds are average — acceptable for most users but improvable by switching to a faster DNS provider. Times over 50 milliseconds indicate a slow DNS server that is adding perceptible delay to every new website you load. If your DNS is slow, switching to Cloudflare (1.1.1.1) or Google (8.8.8.8) typically reduces response times by 30–50% for most connections.

What is the best DNS server to use?

For most users, Cloudflare's 1.1.1.1 is the best DNS server — it is the fastest public DNS resolver globally with a strict no-logging privacy policy audited annually by KPMG. Google's 8.8.8.8 is the most widely used alternative and offers excellent reliability, though it does log some query data. Quad9 (9.9.9.9) is the best choice for users who want automatic malware-domain blocking alongside fast DNS resolution, operated by a non-profit with strong privacy commitments. If you use a VPN, your VPN's private DNS servers are typically the best option because they route queries through the encrypted tunnel, providing both privacy and leak protection.

Can I test my DNS without installing anything?

Yes, the DNS test on this page runs entirely in your browser using standard web APIs and requires no software installation, browser extension, account creation, or payment. It works on any modern browser including Chrome, Firefox, Edge, Safari, and Brave on both desktop and mobile devices. The test makes network requests from your browser to public APIs to detect your DNS server, measure response times, check for DNS leaks, and verify DNSSEC validation — all within a few seconds. No data from your test is stored on our servers or shared with third parties.

What is the difference between a DNS test and a DNS leak test?

A DNS test is a broad term that can refer to any check related to your DNS configuration — server identification, speed, DNSSEC support, or leak detection. A DNS leak test specifically checks whether your DNS queries are being routed through your VPN's private DNS servers or leaking to your ISP's DNS. A DNS leak test is a subset of what a comprehensive DNS test covers. This page runs a complete DNS test including leak detection, while the homepage focuses specifically on the DNS leak test for users who want a quick privacy check.

Does my DNS change when I use a VPN?

Yes, a properly configured VPN overrides your device's DNS settings and routes all DNS queries through the VPN provider's own private DNS servers. This means your DNS server changes from your ISP's DNS (or whatever you have configured) to your VPN's DNS when the VPN connects, and reverts back to your original DNS when the VPN disconnects. This DNS switching is intentional and is a key part of how VPNs protect your privacy — it prevents your ISP from logging your DNS queries while the VPN is active. If your DNS does not change when you connect your VPN, you likely have a DNS leak that needs to be fixed.

Stop leaks for good

A VPN with private DNS on every server, a kill switch and WebRTC protection closes every leak this site tests for.

Get NordVPN →

30-day money-back guarantee · We may earn a commission