What is DNS?
DNS translates domain names (like skypath.cloud) into IP addresses. Every website visit starts with a DNS query.
Whoever resolves that query can see which domains you looked up — even if the page content is encrypted with HTTPS.
Privacy
DNS Leak Test
Free DNS leak check for VPN users — see which DNS resolvers queried a unique SkyPath hostname (classic resolver-trace).
Test report
Resolver-trace — which DNS IPs queried SkyPath
DNS resolvers seenStarting resolver-trace…
| IP | Location | ISP | Hostname | Queries |
|---|---|---|---|---|
| Waiting for DNS queries… | ||||
Methodology: several rounds of unique hostnames → OS DNS → SkyPath Probe authoritative log of which resolver IPs asked. Each IP is named with its network operator so you can tell your VPN’s DNS from your ISP’s.
What this means
A DNS leak is when normal domain lookups go through your ISP (or another unexpected resolver) instead of your VPN’s DNS — revealing which sites you visit.
This test creates a unique hostname and records which recursive resolvers queried SkyPath’s authoritative DNS for it — the classic resolver-trace method.
Compare resolver IPs to your VPN provider’s DNS. If you see your ISP’s resolvers while connected to a VPN, fix OS DNS, split tunneling, or IPv6.
Learn more
How VPN DNS leaks happen
Leaks often occur when the OS keeps using ISP DNS, when split tunneling sends DNS outside the VPN, or when IPv6 DNS bypasses IPv4-only VPN tunnels.
Fixes usually involve enabling the VPN's DNS setting, disabling split tunneling, or blocking non-VPN DNS in your firewall.
How SkyPath’s resolver-trace works
We generate a one-time hostname under a SkyPath-controlled zone. Your browser triggers a normal OS DNS lookup for that name.
SkyPath’s Probe authoritative DNS logs which resolver IPs asked for it. Those IPs are the evidence behind the verdict — not a DoH reachability probe.
How to read your resolver list
Each row is a recursive resolver that asked our authoritative DNS for your one-time hostname, named with the network operator behind that IP so you do not have to look it up yourself.
Your VPN provider's name is the expected result on a VPN. Your home ISP's name while the VPN is connected is the leak. A large public resolver such as Google or Cloudflare means your device or router is set to use it — not a leak by itself, but that operator sees the domains you look up.
More than one resolver is normal. Providers run resolver pools, so several addresses from the same operator can appear for a single lookup.
Run it twice: before and after connecting
A single result cannot tell you what changed. Run this test with the VPN off and note the operator names, then connect the VPN and run it again.
If the same operator appears both times, your DNS is not going through the tunnel. Enable the VPN app's own DNS setting, remove manual DNS overrides, and turn off split tunneling for DNS before re-testing.
Browser secure DNS can differ from your OS resolver
Chrome, Edge, and Firefox can send their own lookups over DNS-over-HTTPS to a resolver you picked in browser settings, while the rest of the operating system keeps using a different one.
This test runs a normal lookup from the browser, so it reports the path your browser actually used. Apps outside the browser may resolve elsewhere. If the result surprises you, check your browser's secure DNS setting as well as your OS and router DNS.
FAQ
What is a DNS leak?
A DNS leak is when DNS requests travel outside your VPN tunnel, exposing your browsing activity to your ISP or another third party.
Does this DNS leak test prove I am safe?
It shows which resolvers queried our unique hostname from your network path. That is strong evidence for VPN DNS behavior, but OS settings, IPv6, and split tunneling can still change on the next connection — re-test after changes.
How do I fix a DNS leak?
Use your VPN app's DNS setting, disable manual DNS overrides, turn off split tunneling for DNS, and consider blocking DNS to addresses other than your VPN. Then re-run this test.
Why are results empty or pending?
The Probe must receive DNS queries for your unique hostname. If authoritative DNS is not delegated yet in an environment, or your network blocks the lookup, results stay pending. Try again or check network filters.
