FIELD NOTE · DNS LEAK
See who answers
your DNS questions.
A VPN tunnel is supposed to hide where you are. If your DNS queries still go to your local ISP, the tunnel leaks. DNS Leak Test shows every resolver your Mac is using right now, with the country and ISP behind each one. The leak becomes visible.
Multi-country resolvers are highlighted as a leak.
What is a DNS leak
When you load a webpage, two things happen: a DNS lookup turns the hostname into an IP, and the actual traffic flows over TCP. A VPN normally tunnels both. A "leak" is when the TCP traffic goes through the VPN but the DNS lookups go straight to your home ISP, exposing the list of sites you visit to anyone watching that ISP. Some VPNs handle this correctly out of the box; many do not.
What you see
One row per active resolver. Columns: resolver IP, country flag, ISP / network operator, and a protocol badge (Do53, DoH, DoT, depending on what your Mac negotiated). Resolvers your Mac is asking right now are listed first; cached entries are below.
Multi-country leaks are the obvious red flag
If two of the resolvers in the list sit in different countries, the Mac is splitting DNS traffic. The most common pattern is VPN resolver in country A + local ISP resolver in country B. The local resolver is the leak. DNS Leak Test marks the row with a leak badge so you cannot miss it.
How to fix a leak
Three options, in order of how robustly they fix the problem:
- Use a VPN client that forces DNS through the tunnel. Most modern WireGuard or Tailscale configs do this; check the "DNS" or "Force tunnel DNS" toggle.
- Set a system-wide DNS resolver in System Settings → Wi-Fi → Details → DNS. Pick a privacy-respecting resolver (1.1.1.1, 9.9.9.9, your VPN provider). Removes the ISP resolver from the equation.
- Enable DNS-over-HTTPS in Safari or use Cloudflare WARP. This is a per-app fix, not system-wide, but it is the simplest if you only care about browsing.
Pairs with ISP Report
ISP Report tells you whose network your traffic exits through. DNS Leak Test tells you whose network your DNS goes through. If those two answers are different ISPs, you have a leak. Open them side by side when something feels off.
Where to find it in the app
Click the menu-bar icon, scroll to Insights at the bottom of the popover. DNS Leak Test sits in the middle row. The list refreshes when the network changes; click Refresh to force a re-test.
TL;DR
A VPN that does not tunnel DNS still leaks the list of sites you visit. DNS Leak Test shows every resolver your Mac uses, flags multi-country leaks, and tells you whether your VPN actually does what you paid it to do.