Linux · How-to
How to Check If Your DNS Is Leaking
Confirm your DNS queries are actually encrypted and going where you intend, not leaking to your ISP.
You'll need: DNS-over-TLS (or DoH) configured via systemd-resolved.
Steps
- Confirm systemd-resolved is using your encrypted resolver: `resolvectl status`. In the Protocols line, `+DNSOverTLS` means DoT is on; `-DNSOverTLS` means it is off (the word appears either way — check the sign).
- Visit a DNS leak test site (e.g. dnsleaktest.com) and run the standard test.
- Check the listed resolvers — they should be your encrypted provider's, not your ISP's.
- If you see your ISP's resolvers, re-check resolved.conf and that DNSOverTLS=yes is set.
- Re-run the extended test to be thorough.
Watch outA padlock and HTTPS don't mean your DNS is private — plain DNS leaks every domain you visit even over HTTPS. Test it explicitly.
Go deeper: Build a Hardened Linux Workstation
The Linux guide has the exact resolved.conf block, DoT vs DoH, and the verification steps.
Get the guide