Skip to contentHow to Test for DNS Leaks
A DNS leak can expose every domain you visit even when your traffic is encrypted. Here is what a leak is, how to test for one, and how to keep name resolution inside the tunnel.
What a DNS leak is — and why it matters
Before your browser can load a page, it asks a DNS resolver to turn a hostname like example.com into an IP address. If that question leaves your device outside the encrypted tunnel — going to your ISP's resolver, say — anyone watching that resolver sees every site you visit. That is a DNS leak, and it happens even when the traffic itself is encrypted.
The whole point of a VPN or proxy is to hide your real or origin IP. A DNS leak breaks that in two ways: the resolver operator learns your browsing, and the resolver you use can betray your true ISP or rough location. You can sit on a VPN endpoint in another country and still hand every lookup to your home ISP.
The fix is simple in principle: resolve names inside the tunnel or at the proxy, never on your local machine. Our WireGuard VPN pushes DNS servers through the tunnel by default, and our datacenter SOCKS5 proxies resolve remotely when you use socks5h. The setup guides cover the exact steps per platform.
How to test for a DNS leak
Note your baseline
Disconnect everything and record your real public IP and the resolver your ISP hands you. This is what a leak would reveal to an observer.
Connect the tunnel or proxy
Bring up WireGuard, or point your client at the proxy. For proxies, use a socks5h URL so DNS is resolved remotely rather than on your device.
Run a leak test
Use a browser-based DNS leak test or the command-line checks below. Look at both your public IP and the resolver actually answering queries.
Compare the results
The resolver and IP shown should belong to the tunnel or proxy. If your ISP's resolver still appears, DNS is leaking and needs fixing.
Check IPv6 and WebRTC
Test IPv6 separately and check WebRTC in your browser — either can expose your real IP even when IPv4 DNS looks clean.
Check DNS from the command line
# Your public IP with the tunnel up — should NOT be your real one curl https://api.ipify.org; echo # Which resolver actually answered? (should belong to the tunnel/proxy) dig +short whoami.ds.akahelp.net TXT # Proxy: socks5h resolves the hostname REMOTELY (no local DNS leak) curl --proxy socks5h://USER:[email protected]:1080 https://api.ipify.org; echo # Wrong: plain socks5 resolves locally first -> leaks the domain # curl --proxy socks5://USER:[email protected]:1080 https://example.com # HTTP proxy: CONNECT tunnels HTTPS, hostname resolved at the proxy curl --proxy http://USER:[email protected]:3128 https://api.ipify.org; echo # WireGuard: confirm a DNS server is pushed through the tunnel grep -i '^DNS' /etc/wireguard/wg0.conf
Where DNS resolves in each setup
Whether DNS leaks comes down to where the lookup happens. This is how the common setups compare:
| Setup | Where DNS resolves | Leak risk |
|---|---|---|
| s4m WireGuard VPN | Inside the tunnel (pushed DNS) | Low |
Proxy with socks5h | Remotely, at the proxy | Low |
Proxy with socks5 | On your local machine | High — domain leaks locally |
| HTTP proxy (CONNECT) | Remotely, at the proxy | Low for HTTPS |
| No tunnel | Your ISP resolver | High |
A paid plan gives you flat-rate VPN traffic plus metered, authenticated datacenter proxies; you can also compare VPN vs proxy to pick the right tool. If you instead use the free public proxy list, remember those entries are third-party and unvalidated for leaks — test each one yourself with the checks above before trusting it.
Quick DNS-leak checklist
Confirm your IP changed
Before and after connecting, check your public IP. If it did not change, fix that before worrying about DNS.
Check the resolver
The DNS server answering your lookups should belong to the tunnel or proxy — not your home ISP.
Keep DNS in the tunnel
On WireGuard, confirm a DNS line is set. On proxies, use socks5h so the hostname resolves remotely.
Test IPv6 and WebRTC
Disable or route IPv6, and check WebRTC in the browser — both can leak your real IP on their own.
Re-test after reconnecting
Leaks can reappear after a reconnect, network change, or sleep/wake. Re-run the test periodically.
Questions, answered
Can DNS still leak while I'm connected to a VPN?
Yes. If your operating system or browser keeps using a resolver outside the tunnel, those lookups leave in the clear even though the rest of your traffic is encrypted. That is exactly why you test rather than assume.
What is the difference between socks5 and socks5h?
With plain socks5, your client resolves the hostname locally and sends only the IP to the proxy — leaking the domain to your local resolver. With socks5h, the hostname is sent to the proxy and resolved there, so no DNS query leaves your machine.
Does the s4m WireGuard config prevent DNS leaks?
Our WireGuard profiles include a DNS line so the client routes lookups through the tunnel. Confirm it is present in your config and re-test after any network change; no setup should be trusted without checking.
Do datacenter proxies hide my DNS?
They can, when you connect with socks5h or an HTTP CONNECT tunnel so resolution happens at the proxy. Note these are datacenter proxies, not residential, and they are metered pay-as-you-go.
What about IPv6 and WebRTC leaks?
Those are separate from DNS. IPv6 can bypass an IPv4-only tunnel, and WebRTC can expose your local IP from inside the browser. Test both alongside your DNS check.
Keep every lookup in the tunnel
Create a account, bring up WireGuard, and run the checklist. Prefer proxies? Connect with socks5h to proxy.s4m.online so hostnames resolve remotely, never on your device.
People found this page by searching for
- how to test for DNS leaks
- wireguard for scraping
- proxy authentication
- wireguard
- best ip address 2026
- proxy for scraping
- http proxy
- buy proxy for scraping
- vpn kill switch tutorial
- ip address
- Playwright proxy configuration guide
- vpn kill switch
- vpn kill switch for windows
- how to hide your IP address
- YouTube unblocked
Real search phrases this page answers — the linked ones open the page that covers them in depth.