DNS Leak Test

DNS converts domain names into network addresses. A DNS leak can happen when a lookup uses a network path outside the protection you intended. This test uses unique test names to observe which recursive DNS resolvers reach our authoritative server. It is evidence about those lookups—not a complete view of every app, DNS query or network route.

Your IP Address
216.73.216.157

Takes about 10-15 seconds. The test identifies resolver addresses that query a unique name. A resolver name does not by itself prove the VPN route.

How This Test Works

  1. We generate unique hostnames under our test domain (leak.zend2.com)
  2. Your browser makes requests to these hostnames, triggering DNS lookups
  3. Our authoritative DNS server sees which resolvers query for these hostnames during the test
  4. We analyze the resolver IPs to identify who handles your DNS queries
  5. We report the resolver addresses and operators that asked for those names. Their identity alone cannot prove whether the lookup traveled inside a VPN tunnel

What this tool can report

The test can identify resolver addresses and network operators that queried our test domain. A resolver might be operated by your ISP, VPN provider, or a public DNS service. Its identity alone cannot prove whether the browser's request traveled inside or outside the VPN tunnel.

Zend2 VPN and public DNS

Zend2 VPN's published policy says its tunnel uses Cloudflare DNS addresses 1.1.1.1 and 1.0.0.1 by default unless a VPN Edge is configured differently. Seeing a public resolver can therefore be expected. This result cannot verify whether the connection used the VPN tunnel, nor what any third-party DNS operator retains. Read the VPN Privacy Policy.

What DNS reveals

Depending on your setup, DNS lookups can reveal domain names to the resolver operator or to observers of unencrypted DNS traffic. A DNS lookup does not reveal the complete URL path or page contents, and it does not follow that your ISP logs every website you visit. Some browsers use DNS-over-HTTPS, which sends lookups to an encrypted DNS resolver instead of the system default. See Firefox DNS-over-HTTPS.

If a result is unexpected

  1. Run the test with your VPN disconnected, recording the resolver names without sharing personal addresses.
  2. Connect the VPN, repeat the test, and compare.
  3. Check any browser Secure DNS / DNS-over-HTTPS selection and the VPN's documented DNS settings.
  4. If results remain unexpected, contact your VPN provider with redacted observations. Avoid turning off IPv6, antivirus, lockdown or other protections as a generic fix.

Privacy

The test domain's authoritative DNS infrastructure necessarily receives resolver-query information to produce the results. This page does not claim zero DNS or IP logging, or a specific deletion schedule, because that retention behavior was not verified against the authoritative DNS server and hosting configuration in this update.

Using an Android VPN?

Zend2 VPN is a live Android app. Its published documents describe WireGuard, an IPv4 tunnel, and default Cloudflare DNS. They do not claim a verified no-logs audit, universal IPv6 protection, or a kill switch. See Zend2 VPN or get Zend2 VPN on Google Play.

Frequently asked questions

A DNS leak can happen when a lookup uses a network path outside the protection you intended. This test observes which recursive resolvers reach the test domain. That is evidence about those lookups, not a complete view of every app, DNS query or network route.

The test uses unique names so the authoritative DNS server can see which recursive resolvers ask for them. It can report resolver addresses and network operators. It cannot directly observe the path between your browser and that resolver.

No. An ISP-associated resolver is a reason to investigate if you expected DNS to follow another path while a VPN was connected. Compare a VPN-off baseline and check the browser's Secure DNS or DNS-over-HTTPS settings. This result alone does not confirm a DNS leak.

No. Zend2 VPN's published policy says its tunnel uses Cloudflare DNS addresses 1.1.1.1 and 1.0.0.1 by default unless a VPN Edge is configured differently. Seeing a public resolver can be consistent with that configuration. It does not verify the VPN route, transport encryption, or what the resolver operator retains.

DNS-over-HTTPS sends lookups to an encrypted DNS resolver instead of the system default. The resolver operator can still see the domain names in those lookups. It does not by itself prove that the lookup traveled inside a VPN tunnel.

Compare a test with the VPN disconnected and a test with it connected. Check the browser's Secure DNS or DNS-over-HTTPS selection and the VPN's documented DNS settings. If the pattern remains unexpected, contact the VPN provider with redacted observations. Do not turn off IPv6, antivirus, lockdown or other protections as a generic fix.

Related checks

Zend2 is coming soon on the App Store

Zend2 is available on Google Play. We are still preparing the App Store release.

Get notified for iOS