DNS Leaks Explained: What a DNS Leak VPN Issue Is and How to Check for One

What exactly is a DNS leak?

Every time you type a web address into your browser, or an app on your phone reaches out to a server somewhere, your device first has to answer a basic question: what IP address does that name actually point to? Domain names like the ones you type or tap are convenient for humans, but the internet's routing infrastructure works in IP addresses, not names. The process that bridges the two is called DNS resolution — DNS stands for Domain Name System — and it happens constantly, often dozens of times per minute, usually without you noticing it at all.

Under normal circumstances, without a VPN running, your device sends these DNS lookup requests to a DNS server your internet provider assigns automatically, or to a third-party DNS service you've configured yourself. Either way, whoever operates that DNS server sees a running list of every domain name your device asks about — not the content of what you do on those sites, but the sites themselves, in something close to real time. For most people, this is simply how the internet has always worked in the background.

When you connect to a VPN, the intent is that this changes: your DNS requests, like the rest of your traffic, should get routed through the encrypted VPN tunnel and resolved using the VPN provider's own DNS servers (or servers it designates), rather than your ISP's. That matters because it keeps the list of sites you're looking up inside the same protected channel as everything else the VPN is supposed to be shielding. A DNS leak is what happens when that doesn't occur as intended — when some or all of your DNS requests continue going to your ISP's DNS servers, or to some other DNS resolver outside the VPN tunnel, despite the VPN app showing a normal "connected" state. The VPN is still encrypting the rest of your traffic; it's specifically the DNS lookups that are slipping out through a separate, unprotected path.

It's a narrow but meaningful gap. A DNS leak doesn't expose the actual content of the pages you load, the messages you send, or your login credentials — those still travel through the encrypted tunnel as usual, assuming the rest of the VPN connection is functioning correctly. What it exposes is the pattern of domain names you're resolving: which sites and services you're looking up, in what order, and roughly when. For someone using a VPN mainly for streaming convenience, that may be a minor issue. For someone relying on a VPN to keep their browsing habits away from their ISP, an employer's network, or a more hostile network operator, it can undermine a meaningful part of why they're using a VPN at all.

Why does a DNS leak happen when I'm already connected to a VPN?

It seems counterintuitive at first — if the VPN is running and encrypting traffic, why would one specific category of request, DNS lookups, find a way around it? The short answer is that DNS resolution is handled by a separate part of your operating system's networking stack from general internet traffic, and a VPN has to deliberately intercept and redirect that separate process. Most of the time, well-built VPN apps do exactly that, and DNS requests get pulled into the tunnel along with everything else without any visible sign that a separate mechanism was even involved. A leak happens when that redirection is incomplete, skipped for part of the traffic, or overridden by something else on the device.

A few underlying causes come up repeatedly:

The VPN app doesn't force DNS traffic through the tunnel at all. Some thinner or lower-quality VPN implementations route general internet traffic through the tunnel but don't specifically override the operating system's existing DNS configuration, leaving DNS lookups pointed at whatever server they were using before the VPN connected — almost always your ISP's.

The operating system has more than one active network path. A laptop that's connected to both Wi-Fi and a wired ethernet connection at once, for instance, or a device that automatically switches between networks, can end up with DNS requests going out over whichever interface the operating system considers "faster" or "preferred" at that moment — which isn't necessarily the VPN's virtual network adapter.

IPv6 isn't being handled by the VPN tunnel. Many VPN connections are built primarily around IPv4 traffic, and if a device also has IPv6 connectivity active and the VPN doesn't explicitly block or tunnel IPv6, DNS requests (and other traffic) can be resolved over IPv6 outside the VPN entirely, bypassing the protection without the VPN app necessarily noticing.

A custom or third-party DNS setting on the device overrides the VPN's DNS. If you've manually configured your device or router to use a specific DNS service — for ad blocking, for speed, or for any other reason — that setting can sometimes take precedence over the DNS server the VPN app tries to assign, depending on how the operating system prioritizes competing DNS configurations.

A transparent DNS proxy on the network intercepts requests regardless of settings. Some ISPs and some public or corporate networks run infrastructure that intercepts outgoing DNS requests on port 53 and redirects them to the network's own DNS servers, no matter what DNS server your device thinks it's using. This is a more aggressive form of interception that a VPN's normal DNS handling doesn't always account for unless the app specifically routes DNS traffic through the encrypted tunnel rather than just changing which server it's addressed to.

None of these causes require the VPN provider to be acting in bad faith. Most DNS leaks are a technical gap — an edge case in how an operating system, a network, or an app's DNS handling interacts with the VPN tunnel — rather than evidence that a provider is deliberately failing to protect DNS traffic. That said, some VPN apps handle this considerably better than others, which is why DNS leak protection is worth checking for specifically rather than assuming any VPN connection automatically covers it.

Why does a DNS leak actually matter?

It's worth being specific about what's at stake, because "DNS leak" can sound like a minor technical footnote next to bigger words like "encryption" and "IP address." In practice, the list of domains a device resolves is a surprisingly detailed proxy for what someone is doing online, even without access to the actual content of their traffic.

Whoever operates the DNS server your requests are leaking to — typically your ISP — can see a running record of every domain you look up: which news sites, which banking portal, which streaming services, which specific forums or health-related sites, roughly what time, and how often. In many countries, ISPs are legally permitted (or in some cases required) to log this kind of data, and in some cases to share it with advertisers, government requests, or other third parties. A VPN that's meant to prevent exactly that kind of visibility, but is leaking DNS requests around the tunnel, is providing a weaker version of the protection it appears to be providing — while still showing "connected" and giving no visible indication anything is wrong.

The specific stakes vary a lot by who's using the VPN and why:

For someone using a VPN mainly to access region-restricted streaming content or to get a bit more privacy from casual network snooping on public Wi-Fi, a DNS leak is a real gap but a relatively low-stakes one — it means the underlying protection is less complete than assumed, not that anything catastrophic follows from it.

For someone using a VPN specifically because they don't want their ISP, employer, or network operator to see which sites they're visiting — for reasons ranging from ordinary preference to genuine safety concerns, as covered in our guide to VPNs for privacy — a DNS leak can undercut the specific thing the VPN was chosen to do. This is also relevant to people in situations covered elsewhere on this site, such as journalists, activists, or anyone whose threat model depends on network-level activity staying private; for those use cases, confirming DNS leak protection isn't a nice-to-have, it's part of the baseline check before trusting a VPN connection with anything sensitive.

A DNS leak also matters because of what it implies about testing generally: a VPN app displaying a "connected" or "protected" status is not, on its own, proof that every category of your traffic is actually routed the way you'd expect. DNS leaks are one of the more common and easiest-to-check examples of that gap between what an app reports and what's actually happening on the network, which is exactly why running an occasional DNS leak VPN check is worth the two minutes it takes rather than assuming the app's status indicator tells the whole story.

What are the different types of DNS leaks?

"DNS leak" gets used as a single umbrella term, but it covers a few technically distinct situations, and knowing which one applies to a given case can help with figuring out how to fix it.

Basic (traditional) DNS leaks

This is the most common and most straightforward case: the VPN routes general internet traffic through its tunnel correctly, but DNS requests continue going to the DNS server your device was using before the VPN connected — usually one assigned automatically by your ISP. This typically happens because the VPN app never changed the device's DNS configuration in the first place, or because another active network setting overrode the change.

IPv6 DNS leaks

Much of the VPN industry's tunneling infrastructure was built around IPv4, the older and still more widely used addressing system. IPv6 is a newer addressing standard that many internet providers and devices now support and use by default alongside IPv4. If a VPN tunnel only handles IPv4 traffic and doesn't explicitly disable or route IPv6, a device with active IPv6 connectivity can end up resolving DNS (and sending other traffic) over IPv6 completely outside the VPN tunnel, even while IPv4 traffic is correctly protected. This has historically been one of the more common causes of leaks with VPN apps that don't explicitly account for IPv6.

Transparent DNS proxy leaks

Some ISPs and some public networks run what's called a transparent DNS proxy — infrastructure that intercepts any outgoing request on the standard DNS port, regardless of which DNS server the request was actually addressed to, and silently redirects it to the network's own DNS servers instead. This means a device can be correctly configured to use the VPN's DNS server, and still have those requests hijacked at the network level before they ever reach the intended server. VPN apps that route DNS traffic through the encrypted tunnel itself, rather than merely pointing the device at a different DNS server address, are more resistant to this particular type of leak.

"Smart" multi-homed DNS resolution leaks

Some versions of Windows, in particular, include a networking feature sometimes described as smart or multi-homed DNS resolution, which can send a DNS query out over whichever available network interface responds fastest — even if that interface isn't the VPN's virtual adapter. This is a Windows-specific behavior that's caused DNS leaks even with VPN apps that handle DNS correctly on other operating systems, and it's part of why DNS leak protection is often implemented as an explicit, separate setting in Windows VPN apps rather than assumed to happen automatically.

A related but distinct issue: WebRTC leaks

WebRTC leaks aren't technically DNS leaks, but they get mentioned in the same breath often enough that it's worth being clear about the difference. WebRTC is a browser technology used for real-time communication features like video calls directly in a browser tab, and it can, under some circumstances, reveal a device's real IP address directly to a website — bypassing the VPN entirely, through a completely different mechanism than DNS resolution. If a DNS leak test tool also reports your real IP address rather than just DNS server information, that's more likely pointing at a WebRTC or general IP leak than a DNS-specific one, and the fix is different (typically a browser-level setting or extension, rather than a VPN DNS setting).

How do you run a DNS leak VPN test?

Checking for a DNS leak doesn't require any special technical background, and it takes a couple of minutes. The general process is the same regardless of which specific tool you use:

1. Note your normal, non-VPN DNS setup first (optional but useful). If you visit a DNS leak testing tool before connecting to your VPN, you'll see which DNS servers (usually your ISP's) your device normally uses. This gives you a baseline to compare against once the VPN is running — if the same servers show up while connected, that's a clear leak.
2. Connect to your VPN as you normally would. Pick whichever server location you'd typically use, and confirm the app shows a normal connected state before testing — testing while the VPN is in the process of connecting or reconnecting can produce misleading results.
3. Visit a DNS leak testing site or use your VPN provider's built-in checker. Several free, browser-based tools exist for this specific purpose (sites like dnsleaktest.com are commonly used, though any independent DNS leak checker works the same way), and some VPN apps now include a similar check directly inside the app itself.
4. Run both the "standard" and "extended" test if the tool offers both. A standard test is quick and checks the DNS servers currently in use; an extended test typically sends a larger number of DNS queries over a slightly longer window and can surface intermittent leaks that a quick single check might miss.
5. Read the list of DNS servers the test reports. The result will show the DNS server(s) that actually resolved your test queries, usually along with the server's operator or approximate location. This is the part that tells you whether you have a leak — covered in detail in the next section.
6. Repeat the test after changing servers, networks, or devices. A DNS leak VPN test result on one server, one network, or one device doesn't necessarily generalize to all of them. If DNS leak protection matters to your use case, it's worth spot-checking again after switching VPN server locations, after connecting from a new network (like a hotel or airport Wi-Fi), or after a VPN app update.

None of this requires installing anything beyond your normal browser and VPN app in most cases, which is part of why it's a reasonable thing to check periodically rather than only once, right after first installing a VPN.

How do you actually interpret the results of a DNS leak test?

The test result itself is usually just a list of one or more DNS servers, each with an IP address and, ideally, the name of whoever operates it. Making sense of that list comes down to one core question: do those servers belong to your VPN provider, or to your ISP (or some other unrelated party)?

If every DNS server listed is operated by your VPN provider (the test tool will often label this clearly, sometimes literally naming the VPN provider), that's the result you want — it means your DNS requests are staying inside the encrypted tunnel and being resolved by servers your VPN controls rather than servers your ISP controls.

If any of the servers listed match your ISP's name, or your ISP's known IP ranges, that's a DNS leak. It means at least some portion of your DNS traffic is reaching your internet provider directly, outside the VPN's protection, regardless of what the VPN app's connection status shows.

If the servers listed belong to a third-party DNS service you didn't expect — a public DNS provider you don't remember configuring, for instance — that usually points to a device or router-level DNS setting taking precedence over the VPN's own DNS assignment, rather than the VPN failing outright. It's still worth treating as a leak in the sense that your DNS traffic isn't going where you'd expect, even if the specific server isn't your ISP.

If the result is inconsistent between the standard and extended test, or between repeated runs, that can indicate an intermittent leak — for example, one caused by a multi-homed DNS resolution behavior that only occasionally picks the non-VPN network interface. Intermittent leaks are easy to miss with a single quick check, which is part of why running the more thorough extended test, or testing more than once, is worth the extra minute.

One nuance worth flagging: seeing your VPN provider's own DNS servers in the result doesn't automatically mean everything is perfect — it confirms DNS isn't leaking to an outside party, but it doesn't independently verify anything about how that provider itself handles or retains DNS query logs. That's a separate question, tied to the provider's logging policy generally, rather than something a DNS leak test alone can answer.

Are DNS leak testing tools always accurate, and can browser-level DNS settings interfere?

Free, browser-based DNS leak testing tools work by having your browser send a handful of lookup requests to test domains controlled by the tool, then reporting back which DNS server actually answered those specific requests. That's a genuinely useful check, but it's worth understanding its scope: it tells you how DNS resolution behaved for that one browser, on that one device, on that one network, at that one moment — not a permanent guarantee covering every app, every device, and every network you might use afterward.

One development worth knowing about specifically is DNS-over-HTTPS (often abbreviated DoH) and the related DNS-over-TLS. Modern browsers increasingly support resolving DNS themselves, encrypted, using their own configured resolver — sometimes a setting a browser enables by default, independent of whatever DNS server the operating system (and, by extension, the VPN) is otherwise configured to use. This isn't the same failure mode as a traditional DNS leak — the requests are still encrypted in transit — but it does mean a browser can be resolving DNS through a completely different path than the rest of the operating system, which can produce a DNS leak test result that's genuinely confusing to interpret: the browser might report a resolver that's neither your ISP's nor your VPN's, because it's using its own independently configured DoH provider instead. If a leak test shows an unfamiliar third-party resolver rather than your ISP, checking your browser's own DNS/secure DNS settings — not just your VPN app — is a reasonable next step before assuming something is broken.

Because of that scope limitation, a few habits make DNS leak testing more reliable in practice: run the test in more than one browser if you use several regularly, since browser-level DoH settings can differ between them; don't rely on a single tool if the result looks ambiguous — cross-checking with a second, independent testing site is a reasonable sanity check; and treat a leak test as telling you about DNS resolution specifically, not as a general substitute for checking whether your actual IP address is exposed, which is a related but separate check most testing sites also offer alongside the DNS-specific results.

What actually causes a DNS leak, beyond the basic mechanics?

The types of leaks covered earlier explain the technical mechanisms; it's also worth understanding the more everyday, practical situations that tend to trigger them, since these are the moments worth being a little more careful about testing.

Switching networks while the VPN is still "connected." Moving from home Wi-Fi to a mobile hotspot, or from one Wi-Fi network to another, can sometimes leave a VPN app showing connected while its underlying tunnel hasn't fully re-established DNS routing on the new network yet. A quick reconnect after switching networks, followed by a DNS check if it's a network you don't trust, is a reasonable habit.

Using a VPN alongside a custom DNS or ad-blocking DNS service. Privacy- or ad-blocking-focused DNS services are popular in their own right, but manually configuring one at the device or router level, on top of a VPN, is a common way to accidentally create a DNS leak — the manual setting can override what the VPN app is trying to enforce, depending on the operating system and how the two settings interact.

Router-level VPN setups with mismatched DNS configuration. Running a VPN at the router level, so every device on a home network is covered, is a common setup covered elsewhere on this site — see our notes on VPN use for protecting a whole household. It adds an extra layer of configuration where DNS settings have to be correctly propagated to every connected device, and a mismatch between the router's DNS configuration and the VPN's intended DNS servers is a realistic source of leaks in that setup specifically.

An outdated or buggy VPN app version. DNS leak protection is implemented in app code, and like any software feature, it can have bugs that get fixed in later updates. Running an old version of a VPN app is a more mundane cause of DNS leaks than any of the network-level explanations above, and one of the easier ones to rule out.

Manually configured VPN protocols without the app's full feature set. Some more advanced users configure a VPN connection directly through their operating system's built-in VPN client, or through a router's native VPN client support, rather than through the provider's own app. That approach can skip DNS leak protection entirely if it's implemented as an app-level feature rather than something inherent to the underlying protocol, which is worth knowing before assuming a manual setup behaves identically to the official app.

How do you fix or prevent a DNS leak?

The right fix depends on which of the causes above applies, but a few general approaches cover most real-world cases.

Use a VPN app with built-in DNS leak protection, and keep it updated

Most well-established VPN providers now build DNS leak protection into their apps as a default, automatic behavior — forcing DNS requests through the encrypted tunnel and to the provider's own DNS servers without requiring any manual setup. Using the provider's official app, rather than a manual protocol configuration, and keeping it updated to the current version, covers the most common causes of leaks without any extra effort. If DNS leak protection is a priority for you, it's a reasonable question to check for specifically when comparing providers — our individual reviews, including our NordVPN review and Proton VPN review, are a starting point for looking at how a given provider's app documents its own DNS handling.

Check for and enable a dedicated DNS leak protection setting

Some VPN apps, particularly on Windows, expose DNS leak protection as an explicit toggle in their settings menu rather than assuming it's always on. If your app has a setting labeled something like "DNS leak protection," "force DNS through tunnel," or similar, confirming it's switched on is a quick, concrete step.

Disable IPv6 if your VPN doesn't fully tunnel it

If a DNS leak test points to an IPv6 leak specifically, and your VPN provider doesn't explicitly support tunneling IPv6 traffic, disabling IPv6 at the device or network level is a common workaround — it removes the second, untunneled path DNS requests (and other traffic) could otherwise use. This is a device-level networking setting rather than something the VPN app itself typically controls, so the exact steps vary by operating system.

Avoid manually overriding DNS settings while a VPN is active

If you use a custom DNS service for ad-blocking or other reasons, be aware that combining it with a VPN can produce exactly the override behavior described earlier. Either rely on the VPN's own DNS handling while it's connected, or confirm specifically — via a DNS leak test — that your combined setup isn't routing DNS outside the tunnel before assuming it works cleanly alongside the VPN.

Use a kill switch alongside DNS leak protection, not instead of it

A kill switch blocks all internet traffic if the VPN connection drops unexpectedly, which protects against a different but related risk — being silently exposed after a disconnection, rather than mid-connection DNS routing. The two features address different failure modes, so having one doesn't substitute for the other; a well-configured VPN setup benefits from both.

Test after any change to your setup, not just once

Because DNS leaks are often triggered by a specific change — a new network, an app update, a new custom DNS setting, a new device — treating a single clean test result as permanent proof isn't quite right. A DNS leak VPN check is quick enough that repeating it after any meaningful change to how you're connecting is a reasonable habit rather than overkill.

Do all VPNs protect against DNS leaks by default?

No, and the honest answer is that this varies meaningfully by provider, by platform, and by app version, which is exactly why testing your own specific setup matters more than trusting a general claim. Most larger, longer-established VPN providers treat DNS leak protection as a baseline, expected feature in their current apps, generally implemented by running their own DNS infrastructure and forcing DNS resolution through the tunnel automatically. That's a reasonable starting expectation, but "most providers handle this well" is different from "every connection, on every platform, every time, is guaranteed leak-free," particularly given how many of the causes covered above — IPv6 quirks, network switches, custom DNS settings, operating-system behavior — sit partly or entirely outside the VPN app's control.

This is also a case where free or lower-quality VPN services deserve particular scrutiny. A VPN service with limited engineering resources, or one that doesn't operate its own DNS infrastructure, is statistically more likely to skip robust DNS leak handling than a larger, more established provider — not because free VPNs are leaking on purpose, but because building and maintaining reliable DNS leak protection across every operating system and network scenario takes ongoing engineering effort that a smaller or less-resourced service may not have invested in to the same degree. Rather than assuming either way, running a DNS leak VPN test on your own connection, with your own provider, on your own devices, is the only way to know for certain how your specific setup behaves.

Does finding a DNS leak mean my VPN provider is untrustworthy?

Not necessarily, and it's worth resisting the urge to treat a single leaked test result as proof of bad faith. As covered earlier, most DNS leaks trace back to a technical gap — an operating system quirk, an IPv6 configuration issue, a network you're connected to, a custom DNS setting you added yourself — rather than a provider deliberately routing your DNS traffic outside the tunnel. Many of these causes are fixable on your end (disabling IPv6, checking a setting, updating the app) without the underlying VPN service being at fault at all.

That said, a leak is still worth taking seriously and acting on once you find one, regardless of its cause. Whether the source turns out to be your VPN app, your operating system, or your own device configuration, the practical effect is the same: your DNS requests are visible to someone they weren't meant to be visible to, for as long as the leak goes unnoticed and unfixed. A single test showing a leak is a prompt to investigate and fix the specific cause, not necessarily a signal to abandon a VPN provider outright — though a provider whose app has a documented pattern of DNS leak reports across many users, especially on its official, up-to-date app, is a different and more legitimate reason for concern.

How often should you actually test for DNS leaks?

There's no fixed schedule that applies to everyone, because how much this matters depends heavily on why you're using a VPN in the first place. A reasonable, low-effort approach: run a DNS leak test once after first setting up a new VPN app, again after any major app update or operating system update, and again any time you connect from an unfamiliar network — a hotel, an airport, a new workplace — where you're relying on the VPN more than usual. For most everyday use beyond that, an occasional spot-check every so often is more about peace of mind than necessity.

If your reason for using a VPN is closer to the higher-stakes end — protecting reporting work, protecting yourself in a hostile network environment, or any situation where DNS-level visibility into your activity carries real personal risk — testing more deliberately, and before any session where it matters most, is worth the small amount of extra friction. In that context, a DNS leak test takes less time than the situations it's meant to protect against are worth.

Practical takeaway

A DNS leak is a narrow but genuinely consequential gap: your general traffic stays encrypted and routed through the VPN as expected, but the specific record of which domains you're looking up escapes the tunnel and reaches your ISP or another outside party instead. It happens for mundane, mostly non-malicious technical reasons — incomplete DNS handling in a VPN app, IPv6 quirks, network switching behavior, or a custom DNS setting overriding the VPN's own — and it's checkable in a couple of minutes with a free DNS leak VPN test, run while connected to your VPN, comparing the DNS servers reported against your provider's own infrastructure. Treat a clean result as confirmation for that specific moment, network, and setup rather than a permanent guarantee, and re-test after any meaningful change — a new network, a new device, an app update — rather than assuming a single good result covers every future connection. Choosing a well-established provider with a track record of handling DNS correctly, and confirming your own setup periodically rather than taking the VPN app's connected indicator at face value, covers the practical side of this for nearly everyone.