Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Can't see how they find this over the web. I'm on Windows, its in my network config. It changes when I use a VPN provider, but not when I use a local socks proxy connected to a remote server over SSH (ProxyCap). None of the publicly available sites are finding my correct IP, but leaktest finds my ISP DNS.
I imagine the protection is in using a VPN that is creating a virtual network adapter and therefore setting DNS providers there, but how is the website detecting my provider?
From the source of https://www.dnsleaktest.com/:
<iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe>
<iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe>
<iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe>
That site generates a random host name and arranges for your browser to request content from that host name. Since the host name has never been served to anyone else before, your browser's request to resolve it is sure to make its way to the primary server for the dnsleaktest.com domain. Since they run their own DNS, whoever they receive the DNS requests from is your DNS provider.
Whether forcing your DNS traffic to go through a tunnel instead of via your ISP depends on who you want privacy from. If you don't want the sites you visit to know where you're from, it's a mild leak: most sites don't bother to track where your DNS requests come from, and anyway they'd have a hard time figuring out which ones are yours, and your requests are likely to be served by some cache anyway. However any site could use the same trick as dnsleaktest if they cared. If you're using a tunnel because you don't want your ISP to know which sites you're visiting, making sure that no DNS request ever reaches your ISP is crucial.
There is a way ( in linux.. dont know for windows environment) to prevent a DNS leak.
You have to find 1 or more public DNS servers and edit your /etc/resolv.conf file by commenting out the first line and deleting the next two.
Then type in the second line nameserver and the ip of the Public DNS server you found.
Your resolv.conf should be like this
## #nameserver 192.168.1.1 <--- the ip of your router
# namserver ...whateveripyoufound(free puplic dns server)
#namserver....secondipyoufound......etc
two will be fine
Then try dnsleaks.com and you will see no dns leaks ( all this with starting the tor service first and if you want you can run proxychains with tor )
The downside is that must do this every time you log on to your machine. The changes you made in resolv.conf are not persistent
