Culvert VPNHow to run a DNS leak test on Android
A DNS leak test shows which resolver answered your lookups while the VPN was on; if it belongs to your carrier or ISP instead of the VPN, DNS is leaking.
A DNS leak test checks which resolver answered your name lookups while the VPN was connected. It does not look at your address; it looks at who asked for the names. If the resolvers it lists belong to the VPN provider, DNS is inside the tunnel. If they belong to your mobile carrier or the ISP behind the Wi-Fi, your lookups are leaving the tunnel, and that network can see every site name you resolve even though the page contents are encrypted.
What the test actually measures
Every time an app opens a site, the phone first asks a resolver to turn the name into an address. Without a VPN, that resolver is the one the network handed out: your carrier's, or your ISP's. With a VPN, the app should replace it with a resolver reached through the tunnel, usually one the VPN provider runs. Where those lookups go, and who can read them, is the subject of where your DNS queries go.
A DNS leak test page works by making your browser look up a handful of unique, random hostnames under a domain the test operator controls. Whichever resolver asks the operator's server for those names is, by construction, the resolver your phone is using right now. The page then shows the address and owner of each resolver that asked. That is the whole trick, and it is why the result can be trusted more than an IP page: the resolver cannot pretend to be someone else, because the lookup has to physically arrive from it. The what a DNS leak is post covers why any of this matters.
Running the test on Android
- Connect the VPN and wait for it to report a connection.
- Open a browser that is inside the VPN. If you use split tunnelling, make sure this browser is not on the exclude list, or the test measures the wrong path.
- Open a DNS leak test page and run the extended or full test if it offers one; the short version sends fewer lookups and can miss a resolver that only answers some of them.
- Read the owner column, not the address column. You are looking for the organisation behind each resolver.
- Disconnect the VPN and run it again, so you know what your carrier's resolver looks like for comparison.
- Repeat on the other network, mobile data if you tested on Wi-Fi, because the two hand out different resolvers.
Reading the results
| Resolver owner shown | Meaning |
|---|---|
| The VPN provider, or a hosting company in the VPN server's city | DNS is inside the tunnel |
| Your mobile carrier or your home ISP | DNS leak |
| A large public DNS operator you did not choose | Private DNS is probably set to that provider, see below |
| Two different owners in one run | Some lookups leave the tunnel; usually a second resolver configured on the phone |
The owner shown for a VPN's resolver is often a hosting or data-centre company rather than the VPN's own name, because that is who owns the address block the server sits in. A resolver in the same city as the server you connected to is the expected result.
Android Private DNS changes the answer
Android has a system setting, Private DNS, that sends lookups over encrypted DNS to a provider you name. When it is set to a hostname, Android uses that provider instead of whatever resolver the VPN configured. The queries still go through the tunnel, so the network cannot read them, but the test will show the Private DNS provider rather than the VPN's resolver.
Whether that is a problem depends on who you would rather have see your lookups: the VPN provider or the DNS provider. If you want the VPN to handle it, set Private DNS to automatic. If Private DNS is in the strict hostname mode and the tunnel cannot reach that provider, the phone fails every lookup rather than fall back, which presents as "connected but nothing loads". The details are in VPN and Android Private DNS.
Split tunnelling and excluded apps
Apps you have excluded from the VPN use the phone's normal network and its normal resolver. That is the point of excluding them, and if you run the test in an excluded browser it will correctly show your carrier. Run it in an app that is inside the tunnel, and remember that anything you exclude has its DNS visible to the network.
What a good VPN does about DNS
The clean design is for the VPN server to run its own resolver, answer only over the tunnel, and not write queries down. Then the test shows a resolver in the server's city, the network you are on sees nothing, and the provider has nothing to keep.
That is how Culvert VPN is built: its servers run their own resolver with query logging compiled out, and more broadly it does not log the sites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id, and it keeps the client's IP address for up to 30 days for abuse handling, as set out in the privacy policy. The app routes every tunnelled app's lookups to that resolver, and it is on Google Play.
Questions people also ask
The test shows a big public resolver, not my VPN's. Is that a leak?
Usually it means Android's Private DNS is set to a named provider, so lookups go to that provider over encrypted DNS instead of to the VPN's resolver. The queries still travel inside the tunnel, but that provider, not the VPN, sees them. Set Private DNS to automatic if you want the VPN's resolver to answer.
Why does the test show several resolvers?
Large resolvers answer from many machines, so one run can show several addresses in the same network. Several entries all owned by the same operator is normal; entries owned by two different operators means some lookups are going elsewhere.
Do apps I have excluded from the VPN show up as a leak?
They use the phone's normal DNS, and if you run the test in a browser you excluded it will report your carrier's resolver. That is the split tunnel doing its job, not a leak.