check if your VPN is leaking your DNS in 30 seconds

your vpn might be lying to you

you pay for a vpn, you turn it on, you see the little lock icon or the "connected" badge, and you assume you're done. your traffic is encrypted, your ip is hidden, nobody's watching. except dns doesn't always get the memo. every time you type a website name, your computer still has to ask "what's the ip address for this thing," and that question can quietly slip out through your isp's resolver instead of your vpn's. that's a dns leak, and it means someone is still logging every site you visit even while you think you're invisible.

step one: confirm your actual exit ip

first you want a baseline. check what ip address the internet thinks you have right now.

curl ifconfig.me

with your vpn on, this should return the vpn provider's exit ip, not your home or mobile ip. if it shows your real isp-assigned address, your vpn isn't even connected properly and you've got bigger problems than dns. if it shows the vpn's ip, good, move to the real test.

step two: the 30 second dns check

this is the one that actually matters. run this:

dig +short whoami.akamai.net

here's what's happening under the hood. whoami.akamai.net is a special domain hosted on akamai's massive dns infrastructure. when you query it, the akamai server that answers doesn't give you a normal ip lookup, it tells you the ip address of the resolver that asked the question on your behalf. so instead of resolving a website, you're basically asking "hey, who's asking you questions for me right now?" and it answers honestly.

dig is just the command line tool for making dns queries directly, and +short strips out all the technical noise so you just get the raw ip address back. clean, fast, no guessing.

reading the result

take the ip address that comes back and compare it to your vpn provider's known dns servers (most vpns list these on their support pages) or just check who owns that ip using a whois lookup. two outcomes:

if the resolver ip belongs to your vpn provider, or to a known private dns service like cloudflare or quad9 that you configured on purpose, you're clean. your dns queries are traveling through the encrypted tunnel just like everything else.

if the resolver ip belongs to your isp, that's the leak. your vpn is encrypting your traffic but your computer is still asking your isp "hey what's the ip for this site" over an unencrypted channel outside the tunnel. your isp can't see what you downloaded, but they can see every domain you visited, which is honestly most of the picture anyway. your browsing history is still sitting in their logs.

fixing it on your own setup

this is the part that actually protects you, so don't skip it. most vpn apps have a setting, usually buried in advanced or network settings, that lets you force all dns traffic through the vpn's own resolvers. turn that on first. it's labeled something like "use vpn dns" or "block dns leaks."

if your vpn doesn't offer that, or you want a second layer, enable dns over https (doh) or dns over tls (dot) at the operating system level. these encrypt the dns query itself regardless of what's handling it, so even if a query somehow escapes the tunnel, it's not readable in plain text. windows 11, android, and most modern browsers support doh natively now, it's usually one toggle in network settings.

after you make the change, run the dig command again. that's the whole verification loop: change a setting, test, confirm. don't trust the fix until the resolver ip actually matches what you expect.

the takeaway

a vpn that leaks dns is only doing half its job. your ip gets hidden but your browsing habits walk right out the back door to your isp anyway. the fix takes less time than reading this post, it's one setting and one command to verify it worked. run the check today, and if you know someone who pays monthly for a vpn and has never once tested it, send them this.