I've tested DNS for a leak at dnsleaktest.com and I'm getting these results:

  • When I'm not specifying DNS on my PC, it's using default ISP's DNS.

  • When I change it to google's DNS:

    • DNS leak test shows a different but nonetheless ISP's DNS instead of the Google's one. (I suppose the ISP is hijacking DNS in this case, right?).

    • Terminal command shows Google's DNS:

      Screenshot nlslookup and ping.

  • When I use VPN, only then I see google's DNS in the DNS leak test in case when I'm using a browser VPN extension or in case a system-wide VPN like "PrivateTunnel".

Are there any methods I can use to prevent that DNS hijacking or do I have to stick with VPNs?

  • To one of the persons answering this question. Could this be prevented with DNSSEC?
    – Bob Ortiz
    Mar 16, 2017 at 21:39
  • Please do not post text as images. It is hard to read, copy paste and search. Perhaps you could edit the question to include the actual text?
    – Anders
    Mar 17, 2017 at 9:31

1 Answer 1


ISP can change the responses you getting from any common DNS server in the internet, unless your DNS resolver and DNS server supports DNSSEC and also the domain in question is secured via DNSSEC.


If you want to have all DNS requests secured, you must use either VPN or you can use DNS resolver capable of DNS encryption in conjunciont with DNS server that offers DNS encryption.

You can use something like this: https://www.opendns.com/about/innovations/dnscrypt/

  • Oh thanks, I just tried the Simple DNSCrypt (a GUI tool for dnscrypt-proxy) and it seems like it's encrypting DNS and the test for a DNS leak now shows the DNS that I specify in the tool. Nice, thanks!
    – Un1
    Mar 16, 2017 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .