Test a DNS Leak in 2 Minutes: Complete Methodology + Per-OS Fixes (2026)

ricco020 Posted on May 30 • Originally published at anonymflow.com Test a DNS Leak in 2 Minutes: Complete Methodology + Per-OS Fixes (2026) # security # privacy # cybersecurity # vpn TL;DR Testing for a DNS leak takes 2 minutes: connect your VPN, open dnsleaktest.com and run the Extended Test, then check whether the DNS servers detected are your VPN's (not your ISP's). If the resolved DNS belongs to BT, Comcast, Verizon, Movistar — or whichever ISP you'd normally use without a VPN — that's a confirmed leak. Three main causes: (1) VPN without "DNS Leak Protection" enabled, (2) Windows Smart Multi-Homed DNS bypassing the tunnel, (3) Browser with DoH enabled separately. The fix takes 5 minutes depending on the case — detailed below by OS and browser. NordVPN, ExpressVPN, and Surfshark enable DNS Leak Protection by default since 2023 and pass leak tests in 99% of our audit sessions. Why DNS leaks exist — 4 documented technical causes A VPN encapsulates your traffic in an encrypted tunnel between your device and the remote VPN server. In theory, all requests — including DNS — go through this tunnel. In practice, several system configurations bypass the tunnel specifically for DNS requests. Understanding the four main causes lets you identify which one affects you and apply the right fix. Cause #1 — Windows and Smart Multi-Homed DNS. Since Windows 8, Microsoft has implemented Smart Multi-Homed Name Resolution (SMHNR) which sends DNS queries to all active network adapters in parallel, keeping the first answer that arrives. When a VPN is connected, Windows sends the request both to the VPN DNS AND to the ISP DNS via the underlying Wi-Fi/Ethernet interface. If the ISP response arrives first (often the case on LAN), it's used — and the ISP has logged the request. Cause #2 — Browsers with DoH enabled separately. Firefox enables DNS-over-HTTPS to Cloudflare 1.1.1.1 by default since 2020. Chrome offers the same. These DoH resolvers completely bypass the system DNS — includi