How the DNS leak test works

A VPN hides your address from the sites you visit. It only protects your DNS queries, though, if your system actually sends them through the tunnel. When it does not, your internet provider still sees every name you look up. That is a DNS leak.

The idea

You cannot ask your browser which DNS resolver it uses. You can, however, make it look up a name that only one server in the world can answer, and then ask that server who came asking.

SkyPing runs that server. It is the authoritative nameserver for leak.skyping.ch, built into netd.

What happens during a test

The page asks netd for a new test. netd hands out a random ID, for example k7q2m9abcdef.
Your browser loads ten tiny images from names like 1.k7q2m9abcdef.leak.skyping.ch. Nobody has ever asked for these names, so no cache can answer them.
Your system passes each lookup to its resolver, which has to ask our nameserver. netd notes the address of every resolver that asks for the ID.
The page fetches the list and shows each resolver with its network and country.

198.51.100.53    Example VPN    NL   VPN
2001:db8:4::53   Example VPN    NL   VPN
203.0.113.10     Example ISP    CH   Leak

If a resolver belongs to your provider while the VPN is on, part of your DNS traffic bypasses the tunnel.

What netd keeps

netd only records IDs it issued itself, so lookups for made-up names leave no trace. A test lives in memory for ten minutes and is then gone. Nothing is written to disk or to a log.

Some resolvers also send a part of your own address along, the EDNS Client Subnet. The test shows it when it happens, because it means your resolver tells other nameservers roughly where you are.

Fixing a leak

Turn on the DNS leak protection of your VPN client, often called "use VPN DNS only".
Check whether your router or operating system forces a fixed DNS server.
If your VPN does not tunnel IPv6, turn IPv6 off while it is connected.

Then run the test again.