What Is a DNS Leak? How to Test and Fix It

You've connected your VPN, verified your IP has changed, and assumed you're private. But there's a subtle failure mode where your traffic is protected while your DNS lookups — the record of every domain you visit — still flow to your ISP. That's a DNS leak, and it quietly undoes much of a VPN's privacy value.

Quick refresher: what DNS reveals

Before connecting to any site, your device asks a DNS resolver to translate the domain into an IP. Whoever answers those queries sees your complete browsing map — every domain, timestamped — even though page contents stay encrypted.

How a leak happens

A correctly working VPN routes DNS queries through its tunnel to its own resolvers. Leaks occur when the operating system bypasses that:

• OS-level overrides — Windows in particular has "smart multi-homed name resolution," which can query all known DNS servers in parallel, including your ISP's.
• Manually configured DNS — a device hard-coded to a resolver outside the tunnel.
• IPv6 leaks — the VPN tunnels IPv4 but the system sends IPv6 DNS queries outside it.
• VPN drops — the tunnel fails momentarily and queries fall back to the default resolver.

How to test for a DNS leak

1. Connect your VPN.
2. Visit a DNS leak test site (search "DNS leak test" — several reputable ones exist).
3. Examine which resolvers answered. If you see your ISP's name among them, you're leaking. If you only see your VPN provider's servers (or the public resolver they use), you're clean.

How to fix a leak

1. Enable your VPN's leak protection — most quality apps have an explicit DNS-leak-protection or "block outside DNS" setting.
2. Use the VPN's kill switch so a dropped tunnel can't spill queries.
3. Disable IPv6 if your VPN doesn't tunnel it (check their docs first — see IPv4 vs IPv6).
4. Remove manual DNS settings on the device and let the VPN manage them.
5. Re-test after each change.

A related failure is the WebRTC leak, which can expose your real IP through the browser itself even with a perfect VPN tunnel — worth testing at the same time.

Frequently asked questions