DNS leak test
Your VPN can be encrypting every byte you send and still let your internet provider keep a complete list of the sites you visit — because the lookup that turns a name into an address went somewhere else. This test measures it directly: your browser resolves hostnames that have never existed, and we report exactly which resolvers came to ask us for them.
Starting the test…
Generating hostnames that have never been resolved before.
Resolvers that asked for your hostnames
Your exit address
—
Its network
—
Observations are held for ten minutes so the page can read them back, then discarded. They are not tied to an account and are never written to our database.
How this is actually measured
Most privacy checks run in your browser. This one cannot, because nothing in your browser knows which resolver your device used — that fact only exists on the network.
1. Unique names
We mint six hostnames nobody has ever requested. Because they are new, no cache anywhere can answer them — the request has to travel all the way to us.
2. Your browser resolves them
The page tries to load each one. Before it can, your device must ask its resolver for an address — and that is the moment being measured.
3. We see who asks
We run the authoritative nameserver for that domain, so the resolver comes to us. Its address is recorded. There is no way to hide this and still get an answer.
4. The loads fail — fine
Nothing is listening at those names, so the connections error out immediately. Irrelevant: the lookup already happened, and the lookup was the whole point.
Reading your result honestly
Seeing several resolvers is normal. Big resolvers query from a pool of addresses, and many ISPs forward to a public service. A list of three or four is common and is not by itself a finding.
What matters is whose network they are on. If a resolver belongs to your home ISP while a VPN is connected, your lookups are leaving the tunnel and your provider has your browsing list. If they sit in the same country and network family as your exit address, that is the correct result.
A resolver’s country is not always yours.Anycast means a resolver in "the United States" may physically be down the road from you. Treat country as a hint, not proof.
DNS leak questions, answered
What is a DNS leak?
Before your device can load a site it asks a resolver to turn the name into an address. Those lookups are a complete record of everything you visit. A DNS leak is when your VPN carries your traffic but those lookups keep going to your ISP’s resolver outside the tunnel — so your ISP still has the list of every site you opened, even though the traffic itself was encrypted and hidden.
How does this DNS leak test work?
Your browser is asked to load several hostnames that have never existed before, under a domain whose authoritative nameserver we run. To load them it must resolve them, and whichever resolver your device actually uses comes to our nameserver to ask. We record the address it came from and show you who it belongs to. The connections themselves fail immediately, which does not matter: the lookup is the measurement, and it already happened.
Why can’t a DNS leak test work without a special server?
Because nothing on your device will tell a web page which resolver it used — that information exists only on the network. The single place it becomes visible is the authoritative nameserver for the name being resolved, since that server sees exactly who came to ask. Any "DNS leak test" that does not control an authoritative nameserver is inferring rather than measuring.
How do I fix a DNS leak?
Use a VPN that pushes its own resolver and routes DNS inside the tunnel; that is a configuration property, not a setting you can add afterwards. Failing that, set your resolver manually at the operating-system level, and turn on encrypted DNS (DoH or DoT) so lookups cannot be read or redirected in transit. On Windows specifically, check that "smart multi-homed name resolution" is disabled, since it deliberately queries every available resolver at once and is a common cause.
What resolver does Phantom VPN use?
The tunnel pushes Cloudflare’s resolvers, 1.1.1.1 and 1.0.0.1. Your queries travel inside the WireGuard tunnel to the exit node and are resolved by Cloudflare from there. We never see them. We also will not claim your DNS stays inside the decentralized network, because it does not — Cloudflare is a third party and their handling is governed by their policy, not ours.
The results show a resolver I did not configure. Is that a leak?
Not necessarily. Large resolvers query from a different address than the one you configured, and many ISPs forward to a public resolver, so seeing an unfamiliar network is common and often harmless. What matters is whose network it is. A resolver belonging to your own ISP while a VPN is connected is a genuine leak. A resolver in the same country and network as your VPN exit is the expected, correct result.
The rest of the check
No single test proves a VPN is working. Each one below closes a different hole.