Home › Guides › Linux
Linux · How-to

How to Check If Your DNS Is Leaking

Confirm your DNS queries are actually encrypted and going where you intend, not leaking to your ISP.

You'll need: DNS-over-TLS (or DoH) configured via systemd-resolved.

Steps

  1. Confirm systemd-resolved is using your encrypted resolver: resolvectl status.
  2. Visit a DNS leak test site (e.g. dnsleaktest.com) and run the standard test.
  3. Check the listed resolvers — they should be your encrypted provider's, not your ISP's.
  4. If you see your ISP's resolvers, re-check resolved.conf and that DNSOverTLS=yes is set.
  5. Re-run the extended test to be thorough.
Watch outA padlock and HTTPS don't mean your DNS is private — plain DNS leaks every domain you visit even over HTTPS. Test it explicitly.

Go deeper: Build a Hardened Linux Workstation

The Linux guide has the exact resolved.conf block, DoT vs DoH, and the verification steps.

Get the guide