DNS Leak Test: What It Is and How to Check

A DNS leak is a privacy failure: your domain lookups go to your ISP even while a VPN or proxy is supposed to hide them. Right now it is a live problem rather than a theory. On August 4, 2026, Mysk researchers disclosed that three WebKit features bypass proxy settings on iOS and macOS, leaking real IPs and DNS queries even through Apple's iCloud Private Relay (Mysk's disclosure, Aug 2026). So what is a DNS leak, why did this bug surface now, and what should you do about it? The rest of this guide answers all three in plain terms.

The short version: a DNS leak happens when your device resolves domain names outside your VPN or proxy tunnel. Anyone at the end of that path sees which sites you visit. You should check even if you trust your VPN, because the same class of failure keeps reappearing across platforms, and the 2026 WebKit findings show it can live in the browser rather than the tunnel.

Key Takeaways

• A DNS leak exposes your lookups to your ISP even on a VPN; a 2016 study found 84% of 283 Android VPN apps leaked DNS requests.
• Three WebKit features bypass proxies on iOS and macOS per Mysk's August 2026 disclosure, and Apple has not patched.
• Test on a third-party site, check WebRTC separately, and fix leaks with DNS over HTTPS plus full-tunnel DNS.

What Is a DNS Leak?

Wikipedia defines a DNS leak as a condition that allows DNS requests to be revealed to ISP DNS servers even when a VPN is active (Wikipedia: DNS leak). The problem is not rare: a 2016 study of 283 VPN applications on Google Play found that 84% of them leaked DNS requests (Wikipedia: DNS leak).

DNS is the phone book of the internet. When you type example.com, your device asks a resolver to translate the name into an IP address, and that resolver is usually your ISP's or a public service such as 1.1.1.1. Every lookup is a small question about where a site lives, and whoever hears the question learns what you are browsing. A VPN normally sends those questions through its tunnel, so only the VPN's resolver sees them.

That is where the leak definition bites. A DNS leak means a lookup escaped the tunnel and reached a resolver outside it. A WebRTC leak is different: the browser's real-time communication features answer a STUN request with your true IP address. Both hand your identity to a third party, but they are separate failures with separate tests, which is why this guide covers them both.

In practice, an escaped lookup names the sites you are about to visit, and collected over time that is close to a full browsing history. Ad networks, content filters, and governments have all used DNS data this way, which is why leak tests exist at all. The stakes climb when your identity is attached, as it is on a phone's always-on internet connection.

Why DNS Leaks Are Trending Right Now

The trigger is a fresh disclosure. On August 4, 2026, Mysk showed that three WebKit features bypass proxy configuration on iOS and macOS: dns-prefetch, WebAuthn passkey lookups, and WebTransport (Mysk's report, Aug 2026). Apple has not patched any of the three vectors, and every iOS browser is exposed because Apple requires WebKit for all of them (AppleInsider's coverage, Aug 2026).

Vector one: dns-prefetch

Web pages can tell Safari to resolve a domain in the background so links feel instant, a speed trick called dns-prefetch. Mysk found these pre-resolutions go through the device's normal DNS path instead of the proxy, and the behavior has existed since iOS 26.0 shipped in September 2025. That is the same month MDN records rel="dns-prefetch" entering Baseline (MDN: rel="dns-prefetch"). Desktop Safari shows the same leak.

Vector two: WebAuthn and passkeys

When a site requests a passkey, the operating system's credential service checks the site's .well-known/webauthn endpoint, and that lookup happens outside the browser's network stack. On iOS 18.0 and later, a page using mediation:"conditional" fires the lookup silently, so visiting a page can leak a query you never asked for. The security irony is sharp: an authentication system meant to protect you adds another way to observe you.

Vector three: WebTransport

WebTransport is the newest vector and the most direct. It opens HTTP/3 connections that ignore the proxyConfigurations setting entirely. MDN shows WebTransport reaching Baseline in March 2026, the same month iOS 26.4 shipped (MDN: WebTransport API). Because the bypass happens at the connection level, no browser setting short of disabling WebTransport closes the gap.

Who is affected, and who is not

The affected-versus-not line falls by proxy type. iCloud Private Relay is affected, but traditional VPNs are not. VPNs tunnel traffic at the system level, below where these WebKit features work, while Private Relay operates as an app-layer proxy (Mysk's post, Aug 2026). Proxy browser Psylo fixed all three vectors in v1.3.1 by blocking dns-prefetch and disabling WebTransport and WebAuthn by default, with a self-test at leaks.psylo.app. Onion Browser at its Silver security level also works, because Lockdown Mode disables WebTransport (per AppleInsider, Aug 2026).

The timing matters because these features have been in the wild for months. iOS 26.0 shipped with the dns-prefetch behavior in September 2025, and iOS 26.4 added the WebTransport bypass in March 2026, so up-to-date iPhones have been leaking through Private Relay since those releases. That is a long window with no patch, and a private browsing session is only as private as the network stack beneath it.

How to Test for DNS Leaks

You can test for a DNS leak in about five minutes, and the technique is simple once you know it. Sites like dnsleaktest.com and browserleaks.com hand your browser a unique subdomain, then watch which DNS servers answer for it. If any resolver outside your VPN appears in the results, you are leaking. Run the same test with your VPN off and compare, and you will see exactly what your ISP sees.

1. Record your baseline IP with the VPN off. Our ip address lookup tool shows the public address and network your ISP assigns you.
2. Connect your VPN, or turn on iCloud Private Relay on your Apple devices.
3. Visit dnsleaktest.com or browserleaks.com and run the extended test. The results list every resolver that answered for your unique subdomain.
4. Compare the list against your VPN provider. Any server that is not theirs means DNS is escaping the tunnel.
5. Run a separate WebRTC leak test. DNS tests do not catch WebRTC, so treat this as a distinct check, not a repeat.

That unique-subdomain trick is the whole game. The test site only ever serves your session's subdomain, so the only entities that can resolve it are the DNS servers your device actually uses. If your VPN worked perfectly, the only resolver in the list would be the VPN's. Anything else is a leak, plain and simple.

Interpreting the results is the easy part. A clean test shows only your VPN provider's servers, usually named after the company or its locations. A leaking test shows your ISP's servers, a public resolver you never configured, or a mix of both. Keep the unique subdomain in mind as you read the list: the presence of any third-party resolver means a lookup went somewhere it should not have gone.

On iOS, add one more check: leaks.psylo.app, the self-test from the browser that fixed the WebKit vectors. It reports whether your current browser leaks dns-prefetch or WebTransport traffic, which a normal DNS leak test cannot see because those lookups happen outside the browser's own resolver path.

How to Fix a DNS Leak

DNS over HTTPS is the standard fix, formally defined by RFC 8484, published in October 2018, which specifies how DNS queries ride inside HTTPS connections (RFC 8484). One caveat up front: DoH closes tunnel-level leaks, not the browser-level WebKit vectors covered below. The honest trade-off is that DoH moves your lookups from your ISP to a resolver you choose. Your queries do not disappear; they change hands, so pick that resolver deliberately.

Turn on DNS over HTTPS or DNS over TLS

Every major browser and operating system now ships a DoH setting. Chrome, Firefox, and Edge put it under privacy and security; Windows has it under DNS settings; Android has it under Private DNS. Each lets you choose a provider such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8. RFC 8484 standardizes the transport, not the trust, so your chosen resolver is the new observer (RFC 8484).

DoT works the same way over a dedicated port, and many VPN apps let you pick between the two. If your VPN offers its own encrypted DNS, prefer that, because the queries stay inside the tunnel. Fix the tunnel first, then add DoH as a second layer, and test between every change.

Kill split tunneling and route DNS through the tunnel

Split tunneling is the classic cause of leaks, because it sends selected traffic outside the VPN while DNS resolution stays on the physical connection. In your VPN app, disable split tunneling or set it to route all apps through the tunnel. Then check the DNS settings inside the VPN, not the system settings, and make sure lookups use the VPN's own resolver. That is the standard fix for a VPN DNS leak, and it takes thirty seconds.

The Android history

Android has leaked DNS outside VPN tunnels more than once. Mullvad documented the failure mode in detail and explained which OS versions needed a workaround (Mullvad's Android report). The lesson applies beyond Android: a VPN is only as leak-free as the operating system it runs on, so re-test after every OS update.

Until Apple patches WebKit

If you are on iOS or macOS, the 2026 WebKit findings need browser-level answers until Apple ships a fix. Onion Browser in Lockdown Mode disables WebTransport, and Psylo blocks dns-prefetch and disables WebTransport and WebAuthn by default (per AppleInsider, Aug 2026). A VPN alone will not close these vectors, because they bypass the app-layer proxy rather than the system tunnel.

Understand what iCloud Private Relay actually does

iCloud Private Relay is not a VPN, and knowing the difference keeps expectations honest. It is a paid iCloud+ feature that arrived in June 2021. Traffic takes a dual-hop path: an Apple ingress and a third-party egress operated by Cloudflare or Fastly, using MASQUE and Oblivious DNS over HTTPS, so no single party sees both your identity and your destination (Wikipedia: iCloud Private Relay). That design is strong, but the WebKit disclosure shows it still depends on apps above it honoring the proxy.

DNS Leaks vs WebRTC Leaks

The short answer: a DNS leak reveals which sites you visit, while a WebRTC leak reveals your real IP address, and both defeat a VPN's purpose. They are distinct failures with distinct fixes, but they share a symptom, your true identity reaching someone outside the tunnel, so leak tests bundle them together. The contrast, in one table:

	DNS leak	WebRTC leak
What leaks	Your DNS queries	Your real IP address
How it happens	Resolver answers outside the VPN tunnel	Browser STUN requests answer outside the tunnel
How to test	DNS leak test with unique subdomains	WebRTC leak test
Typical cause	Split tunneling, app-layer proxy bypass	WebRTC enabled with STUN servers

WebRTC is the browser feature behind voice calls, video, and peer-to-peer data. To set up a connection it asks a STUN server for your public address, and a leak happens when that answer comes back without going through your VPN. The fix differs from DNS: disable WebRTC where your browser allows it, or use an extension that forces it through the tunnel.

A WebRTC leak is the more direct exposure. It reveals your address directly, the single most identifying piece of data on the internet. A DNS leak reveals your browsing habits, which accumulate into a profile over time. Fix both; the same ten-minute test session catches both.

Related Tools & Further Reading

The tools below you can run today; the guides give context for the leak landscape, including the WebAuthn vector at the center of the WebKit disclosure.

• IP Address Lookup: see your public IP before and after connecting a VPN, the baseline every leak test needs.

• SSL Checker: inspect the TLS certificate of any domain, useful when you are auditing the resolvers and sites in your DNS path.

• What Are Passkeys?: passkey lookups are one of the three WebKit leak vectors, so this primer doubles as context for the disclosure.

• How Technology Detection Works: leak tests and browser fingerprinting both reconstruct who you are from network behavior, and this guide shows the other side of the coin.

• What Is DNS over HTTPS?: the standard fix for tunnel-level leaks, and how to enable it.

• DNS over HTTPS vs DNS over TLS: which encrypted DNS protocol fits your setup.

• WebRTC Leak Test: the separate leak vector that DNS tests miss.

• iCloud Private Relay Explained: what Apple's proxy does and does not hide.