Privacy · encrypted DNS, no leaks

DNS Leak: What It Is and How to Prevent It

When you switch to private DNS, you expect every query to go to the private resolver you chose. A DNS leak is what happens when that promise breaks: your query slips past your encrypted DNS tunnel and reaches a resolver you never meant to use — most often your internet provider's. The result is that your browsing history, which you configured DNS to keep private, is exposed to your ISP or a third party after all. The fix has two sides. You detect a leak with a leak test, which checks which resolver actually answered your query. And you prevent it with encrypted transport — DoH, DoT and DoQ — plus a no-log filtering forwarder like AEU DNS that never stores your queries in the first place.

How a DNS leak is detected and stopped

A leak test shows who answered. A leak test sends a uniquely-labelled query from your browser and reports which resolver returned it. If the answer comes from your ISP instead of your private DNS, you have a leak.

Encrypted DoH/DoT/DoQ seals the tunnel. DoH (DNS over HTTPS), DoT (DNS over TLS) and DoQ (DNS over QUIC) carry your queries inside an encrypted channel, so they cannot fall out in plain text to an unintended resolver on the path.

No-log by design means nothing to expose. Even the resolver you do choose sees the bare minimum. AEU DNS is a no-log filtering forwarder: it filters ads, trackers and malware, forwards the query, and stores nothing about your browsing by design.

Filtering forwarder, not a resolver. AEU DNS is not a resolver. It filters and refines each query, then forwards it to an upstream resolver over encrypted transport — so your queries stay protected and private end to end.

A leak test and encrypted transport — two parts of one defence

Detecting a leak and preventing one are different jobs. You need both, and AEU DNS gives you the prevention side.

The leak test = detection. A leak test tells you the truth about where your queries actually go, right now. It is a snapshot, not a fix — but it is how you know you are safe.

Encrypted DoH/DoT/DoQ = prevention. Encryption keeps every query inside a sealed tunnel to your chosen resolver, closing the path a leak would use. This is the actual fix for a DNS leak.

No-log forwarder = nothing to leak. AEU DNS adds the last layer: a filtering forwarder that never logs your queries. Even in the worst case, there is no stored history for anyone to see.

Leak-proof by design — nothing to configure

AEU DNS is a privacy-first European filtering forwarder: it filters ads, trackers and malware, then forwards each query to an upstream resolver over encrypted DoH, DoT or DoQ. It validates DNSSEC, never stores logs by design, and sits under EU/GDPR jurisdiction — so a leak test against your AEU DNS profile should always show your AEU DNS resolver, never your ISP.

Stop DNS leaks in two minutes

Create a free account, get your DNS profile and a personal certificate, and copy-paste one configuration onto any device — then run a leak test to see it working.

Create your account

Keep exploring

Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. See how GDPR-compliant DNS keeps your DNS inside EU privacy law.

Frequently asked questions

What is a DNS leak?

A DNS leak happens when a DNS query that should go to your private resolver instead reaches an unintended resolver — most often your internet provider's. It exposes the websites you visit to a party you never chose, even though you configured private DNS.

How do I test for a DNS leak?

Run a leak test: it sends a specially-labelled query from your browser and reports which resolver answered. If the resolver shown is your ISP rather than your private DNS provider, you have a leak. Run the test on each device and network you use.

What is the difference between a resolver and a filtering forwarder?

A resolver answers DNS queries itself. A filtering forwarder sits in front of an upstream resolver, filters each query against ad, tracker and malware lists, then forwards it. AEU DNS is a filtering forwarder, not a resolver.

Does encrypted DNS prevent DNS leaks?

Yes — that is its job. DoH, DoT and DoQ carry your queries inside an encrypted tunnel to your chosen resolver, so they cannot fall out in plain text to an unintended resolver on the path. Encryption is the actual fix for a leak.

Does AEU DNS keep logs of my queries?

No. AEU DNS is no-log by design: it filters and forwards your query, then keeps nothing that could reconstruct your browsing history. It is a European, privacy-first service under EU/GDPR jurisdiction.