GlossaryPrivacy & SecurityIntermediate

DNS Leak

A DNS leak happens when your device sends domain lookups outside the VPN tunnel, so your ISP can still see every site you visit even though the traffic itself is encrypted.

Last updated July 29, 2026

Definition

A DNS leak occurs when the requests that translate domain names into IP addresses travel outside your VPN tunnel. Your browsing is encrypted, your IP is hidden — and yet a complete list of every site you visit is still being handed to your internet provider.

What DNS does, briefly

Computers route by numbers, not names. Before your browser can load a site it asks a DNS resolver to convert the domain into an IP address. That lookup is a separate request from the page load itself, and by default it goes to whichever resolver your network hands you — usually your ISP.

Why the leak matters

People assume a VPN covers everything. Consider what the two parts reveal separately:

  • Working correctly — the lookup goes through the tunnel to the VPN provider's resolver. Your ISP sees encrypted traffic to a VPN server and nothing more.
  • Leaking — the lookup goes straight to your ISP. They cannot read the page contents, but they have the domain, the timestamp, and your account. For most privacy purposes that is the sensitive part.

Encrypting the contents while announcing every destination in the clear defeats much of the point of the VPN.

Common causes

  • Operating system shortcuts. Windows in particular may query several resolvers at once and use whichever replies first, bypassing the tunnel.
  • IPv6. Many VPNs only tunnel IPv4. If your connection supports IPv6 and the VPN ignores it, those lookups escape entirely.
  • Manual DNS settings. A resolver hard-coded in your OS or router can override what the VPN wants to use.
  • Split tunnelling. Excluding apps from the VPN can exclude their DNS traffic too.
  • Reconnects. A brief drop can push lookups outside the tunnel before it re-establishes.

How to test

Connect the VPN, then visit any DNS leak test site. It will report which resolvers answered your lookups. If the results show your own ISP, or servers in your real country while you are connected elsewhere, you are leaking. Run the extended test too, since intermittent leaks only appear across multiple queries.

How to fix it

  1. Enable your VPN app's DNS leak protection — most have it, and it is not always on by default.
  2. Disable IPv6, either in the VPN settings or on the operating system, unless the VPN explicitly supports it.
  3. Clear any manually configured DNS servers in your OS and router.
  4. Turn on the kill switch so nothing escapes during reconnects.
  5. Retest, and if it still leaks, change provider — a VPN that leaks DNS is not doing the job you pay it for.

Note that a kill switch does not solve this. It reacts to the tunnel failing, whereas a DNS leak happens while the tunnel is up and apparently healthy. They are separate protections and need testing separately.

Examples

1

A leak test showing your ISP's resolver while you are connected to a VPN server in another country

2

Windows querying several DNS servers at once and using whichever answers first, bypassing the tunnel

3

IPv6 lookups escaping a VPN that only tunnels IPv4 traffic

4

A router with a hard-coded DNS server overriding whatever the VPN app tries to set

Common Use Cases

Verifying a VPN genuinely protects your browsing history
Diagnosing why a VPN fails to unblock regional content
Auditing privacy on a network you do not control
Confirming DNS leak protection actually works before relying on it
Testing corporate VPN configurations
Comparing providers during a trial period

Frequently Asked Questions

The domain names you look up. The page contents stay encrypted, but your ISP receives a timestamped list of every site you visited, tied to your account. For most privacy purposes that list is the sensitive part.
Connect the VPN and open any DNS leak test site. It reports which resolvers handled your lookups. Seeing your own ISP, or servers in your real country while connected elsewhere, means you are leaking. Use the extended test to catch intermittent cases.
No, they solve different problems. A kill switch reacts when the tunnel fails. A DNS leak happens while the tunnel is up and working normally, so you need DNS leak protection as its own feature and should test it separately.
Many VPNs only tunnel IPv4. If your network supports IPv6 and the VPN ignores it, IPv6 lookups bypass the tunnel entirely. Disabling IPv6 removes that escape route unless your provider explicitly supports it.
Yes, and this is what makes it easy to miss. An IP check can show the VPN server address while lookups still travel to your ISP. The two are separate channels and must be tested independently.
Frequently, yes. Leak protection takes engineering effort and infrastructure that free services often skip, and some monetise browsing data outright — which makes leaking DNS a feature rather than a bug from their perspective.

Keep Learning

All terms

VPN

A VPN (Virtual Private Network) encrypts all of your device's internet traffic and routes it through a remote server, hiding your IP and protecting data on untrusted networks.

Read definition

DNS (Domain Name System)

DNS is the internet's address book: it turns a name like example.com into the numeric IP address a computer needs before it can open a connection — and it quietly reveals every site you visit while doing so.

Read definition

WebRTC Leak

A WebRTC leak exposes your real IP address through the browser's built-in real-time communication feature — even when you are using a VPN or proxy.

Read definition

No-Logs Policy

A no-logs policy is a VPN or proxy provider's commitment not to record what you do online — your browsing, connections, traffic or real IP.

Read definition
Back to Glossary