DNS Leak: What It Is and How to Stop It

A DNS leak happens when your device sends Domain Name System (DNS) queries outside the encrypted tunnel of a VPN, exposing which websites you visit to your internet service provider (ISP) or another third party. You enter a website name, your device asks a DNS resolver to translate it into an IP address, and if that request bypasses the VPN, your browsing history is visible even though your traffic appears encrypted. This article explains how leaks occur, how to detect them, and the practical steps you can take to prevent them.

How DNS Works in Normal Browsing

When you type a domain like example.com, your computer needs the numeric IP address of the server that hosts it. It sends a DNS query to a resolver—usually operated by your ISP—which looks up the address and returns it. This happens every time you visit a new domain, and it happens in plain text by default.

Your ISP can log these queries, and in many countries they are legally required to retain them for a period. Even if you use HTTPS, the DNS query itself is often unencrypted, so the ISP sees the domain name even though it cannot see the content of the pages you load.

How a VPN Is Supposed to Protect DNS

A VPN creates an encrypted tunnel between your device and a VPN server. All your internet traffic, including DNS queries, should travel through that tunnel. The VPN server then forwards your requests to a DNS resolver—often one operated by the VPN provider itself—and returns the answers through the same encrypted channel.

In a correctly configured VPN, your ISP only sees a single stream of encrypted data flowing to the VPN server. It cannot see which domains you are querying. The VPN provider, however, can see those queries, which is why privacy-focused users often choose a provider with a strict no-logs policy.

Why Do DNS Leaks Happen?

DNS leaks are usually the result of a configuration flaw, not a deliberate attack. The most common causes are:

IPv6 traffic not routed through the VPN: Many VPNs only tunnel IPv4. If your network uses IPv6 and your VPN does not support it, DNS queries sent over IPv6 bypass the tunnel entirely.
Windows DNS settings overriding the VPN: Windows has a feature called Smart Multi-Homed Name Resolution that sends DNS queries to all available DNS servers, including the one from your normal network, if the VPN connection is slow or fails to respond quickly.
VPN kill switch not enabled: If the VPN connection drops, your device automatically falls back to the regular network connection and its normal DNS servers. Without a kill switch, traffic continues without protection.
Manual DNS configuration: If you have manually set DNS servers in your operating system or router, those settings may take precedence over the VPN’s DNS servers.
Transparent DNS proxies: Some ISPs intercept DNS queries and redirect them to their own servers, even if you have configured a different resolver. This is more common in certain regions and can cause a leak even when your settings look correct.

How to Check for a DNS Leak

The simplest way to test is to use a dedicated DNS leak test website. These sites show the IP address of the DNS server your device is actually using. If that IP belongs to your ISP or is located in your physical region, you have a leak.

To get a reliable result:

Connect to your VPN and choose a server in a different country.
Visit a DNS leak test site and note the displayed IP addresses.
Repeat the test on the same site with the VPN disconnected.
If the IPs match, your DNS queries are going through your regular connection, not the VPN.

Run the test twice: once with IPv4 and once with IPv6, because some leaks only affect one protocol. Also try restarting the VPN connection and re-testing, as some leaks appear only after a connection drop.

How to Prevent DNS Leaks

Prevention depends on your operating system and VPN client, but the following steps cover the most common scenarios:

Enable the kill switch: Most VPN clients have a built-in kill switch that blocks all internet traffic if the VPN connection drops. Turn it on and test it by disconnecting the VPN mid-session.
Disable IPv6 or route it through the VPN: If your VPN does not support IPv6, disable IPv6 on your network adapter. On Windows, you can do this in the adapter’s properties; on macOS, in Network settings. Alternatively, choose a VPN that fully supports IPv6.
Change your DNS servers manually: Set your system’s DNS to a public resolver like Cloudflare (1.1.1.1) or Google (8.8.8.8). This does not encrypt queries, but it stops your ISP from being the resolver. For full encryption, use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) where your OS supports it.
Use your router’s VPN client: If your router supports VPN configuration, set it up there. This protects all devices on your network, including smart TVs and IoT devices that cannot run a VPN app.
Verify your VPN’s DNS settings: In the VPN app, look for options like “Use VPN DNS” or “Prevent DNS leaks” and make sure they are enabled.
Test after every update: Operating system updates and VPN client updates can reset settings. Re-run the leak test after any major update.

DNS Leak vs. WebRTC Leak

A DNS leak is often confused with a WebRTC leak, but they are different. WebRTC is a browser technology used for video calls and file sharing. It can reveal your real IP address even when you are using a VPN, because it bypasses the proxy settings. A DNS leak, on the other hand, reveals the DNS resolver you are using, which indirectly shows your ISP and approximate location.

Both can compromise your privacy, but they require different fixes. WebRTC leaks are usually blocked by browser extensions or by disabling WebRTC in the browser settings. DNS leaks are fixed at the system or VPN level.

Does a DNS Leak Matter If You Use HTTPS?

Yes. HTTPS encrypts the content of your web traffic, but the DNS query happens before the connection is established. The domain name itself is sent in plain text during the DNS lookup. Your ISP can see that you visited example.com, even though it cannot see the specific pages or data you exchanged.

In some cases, the DNS query also reveals the subdomain, which can be even more revealing. For instance, health.example.com indicates you visited a health-related section. This metadata is valuable to advertisers, ISPs, and anyone monitoring your connection.

Frequently Asked Questions

Can a DNS leak reveal my exact location?

Not your street address, but it can reveal your approximate geographic region. DNS servers are often located in specific cities, and the IP address of the resolver can be geolocated to a city or region. Combined with other data, this can narrow down your location considerably.

Is a DNS leak the same as an IP leak?

No. An IP leak reveals your real IP address, which directly identifies your connection. A DNS leak reveals the DNS resolver you are using, which indirectly identifies your ISP and region. A VPN can have one without the other, though both are privacy risks.

Do free VPNs cause more DNS leaks?

Free VPNs often have less robust configurations and may not include a kill switch or IPv6 support. Some free VPNs have been found to log user data or inject ads. That does not mean every free VPN leaks, but you should test any VPN you use, free or paid, with a leak test.

Can I fix a DNS leak on my router?

Yes, if your router supports VPN configuration. You can set up the VPN on the router and also configure the router’s DNS settings to use a resolver you trust. This protects all devices on your network, but the router’s processing power may limit speed.

Does using a public DNS server like 8.8.8.8 prevent leaks?

It prevents your ISP from being the resolver, but it does not encrypt the query. Your ISP can still see that you are sending DNS queries to 8.8.8.8, and in some cases, they can intercept them. For full protection, use DNS-over-HTTPS or DNS-over-TLS, which encrypt the query itself.

How often should I test for DNS leaks?

Test whenever you change VPN providers, update your operating system, or change network settings. It is also wise to test a new VPN before relying on it for sensitive activities. A monthly check is a good habit for regular users.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →