DNS Leaks Explained: How to Test for and Prevent Them

A DNS leak happens when your device sends DNS queries outside the VPN tunnel, usually to your internet provider's resolver, instead of through the encrypted connection you thought was protecting you. The traffic itself stays encrypted, but the lookups that turn domain names into IP addresses do not. That gap quietly hands over a record of every site you visit.

If you already run a VPN for privacy, this is the leak that catches people off guard. You see the connected icon, you assume you're covered, and meanwhile your ISP keeps logging the domains you request. Below, you'll learn what DNS actually does, why a leak undermines your VPN, what causes one, how to test for it in minutes, and how to shut it down.

Key Takeaways

• A DNS leak exposes the domains you visit even when your VPN encrypts the rest of your traffic.
• The usual culprits are IPv6, WebRTC, operating system resolver settings, and transparent DNS hijacking by ISPs.
• You can test in under a minute using a DNS leak test site and checking which resolver answers your queries.
• Fixes include forcing the VPN's own DNS, disabling IPv6 and WebRTC, and choosing a VPN that pushes its resolver to your device.

What does DNS actually do?

DNS, the Domain Name System, is the lookup layer of the internet. When you type a website address, your device asks a DNS resolver to translate that human-readable name into a numeric IP address. Computers route traffic by IP, not by name, so this translation happens before nearly every connection you make.

Think of it as the internet's phone book. You know the name; the resolver knows the number. By default, that resolver belongs to your internet provider, which means your ISP sees a request for every domain you load. Even when the connection that follows is encrypted with HTTPS, the question "what is the address for this site?" still travels in the open unless something protects it.

What is a DNS leak and why does it matter?

A DNS leak is when those name lookups bypass the VPN tunnel and reach a resolver outside it, typically your ISP's. Your VPN still encrypts the data you send and receive, so the contents stay private. But the resolver that answers your queries can log a timestamped list of every domain you requested, which defeats much of the reason you connected in the first place.

Why does this matter so much? Because a domain log is a behavioral profile. It reveals the news sites you read, the services you use, and the health or financial sites you check. An observer doesn't need the page contents to draw conclusions. The pattern alone is revealing, and it ties that activity to your real IP address.

This is the kind of false sense of security that shows up in plenty of VPN privacy myths debunked. The connection icon says you're protected. The DNS path says otherwise. A VPN that handles your data traffic but lets your queries slip out is only doing half the job, and you'd never know without testing.

A DNS leak means your VPN encrypts what you send but not the questions you ask. The resolver that answers those questions, often your ISP, records every domain you visit alongside your real IP, producing a behavioral profile that undermines the privacy you connected for.

What causes a DNS leak?

Most DNS leaks trace back to how your operating system, browser, or network was configured before the VPN ever started. The VPN sets up an encrypted tunnel, but it can't always override every path your device uses to resolve names. A few specific mechanisms cause the overwhelming majority of leaks.

• IPv6: Many VPNs only route IPv4 traffic. If your network supports IPv6 and the VPN doesn't handle it, IPv6 DNS queries escape the tunnel entirely.
• WebRTC: This browser feature, built for real-time calls and video, can reveal your real IP and trigger lookups that bypass the VPN, even when the tunnel is otherwise solid.
• OS resolver settings: Your operating system may keep using a manually set or DHCP-assigned resolver instead of the one the VPN tries to apply.
• Transparent DNS hijacking: Some ISPs intercept all DNS traffic on port 53 and force it to their own resolvers, regardless of what you configured.
• Manual DNS configuration: A static resolver you set earlier, say a public DNS for speed, can override the VPN's settings and send queries straight out.
• Split tunneling: When you route only some apps through the VPN, the excluded apps, and sometimes their DNS, travel over your normal connection.

Notice the pattern. None of these are failures of the encryption itself. They're routing gaps, places where a query finds a path around the tunnel. That's why a working VPN and a leaking VPN can look identical from the outside.

How do you test for a DNS leak?

Testing for a DNS leak takes a minute and confirms exactly which resolver answers your queries while the VPN is connected. The goal is simple: every lookup should be answered by a server inside your VPN's network, not by your ISP. If your home provider's name shows up in the results, you have a leak.

1. Note your baseline first. With the VPN off, visit a DNS leak test site and record the resolver and IP it reports. That's your ISP's setup.
2. Connect your VPN. Wait for it to fully establish the tunnel before continuing, and confirm the connected status.
3. Run a leak test. Reload the DNS leak test site, or use your VPN provider's own check page. Choose the extended or full test if offered.
4. Read the resolvers shown. Look at every DNS server and IP listed. They should belong to your VPN, not your ISP or a recognizable home-region provider.
5. Check both protocols. If you have IPv6, look for separate IPv6 results. An IPv6 address pointing to your ISP is a classic leak.
6. Test WebRTC separately. Use a WebRTC leak checker, since browser-level leaks don't always appear in standard DNS tests.
7. Compare against your baseline. If the resolver matches what you saw with the VPN off, queries are escaping the tunnel. If it's entirely the VPN's infrastructure, you're clean.

One caveat from working with these tools: a single passing test isn't a permanent guarantee. Network changes, OS updates, and reconnecting on new Wi-Fi can reintroduce a leak. We've found it's worth re-testing whenever you switch networks, especially on travel or public Wi-Fi security situations where the local network actively manipulates DNS.

How do you prevent and fix DNS leaks?

You prevent DNS leaks by closing every path that lets a query bypass the tunnel. That means forcing the VPN's resolver, shutting down the features that cause leaks, and choosing a VPN built to push its own DNS to your device. Most fixes are one-time configuration changes you can verify with another leak test afterward.

• Use a VPN that pushes its own DNS. The cleanest fix is a VPN that assigns its resolver automatically when you connect, so your OS never falls back to the ISP's.
• Disable IPv6 at the operating system level if your VPN doesn't fully tunnel it. This removes the most common leak path on modern networks.
• Turn off WebRTC in your browser, or install an extension that blocks it. This stops browser-level lookups from escaping.
• Enable the kill switch your VPN offers, so traffic, including DNS, stops entirely if the tunnel drops.
• Clear manual DNS overrides. Remove any static resolver you set earlier so the VPN's settings take effect cleanly.
• Avoid unnecessary split tunneling. If you must use it, confirm that excluded apps don't carry sensitive activity.
• Re-test after every change. Run the leak test again to confirm the fix actually took hold.

There's a structural point worth making here. On a shared VPN with hundreds of users behind one resolver, your queries blend in, but you're trusting that operator's DNS handling entirely. A dedicated, single-tenant server gives you a resolver path that only you use, which makes leak behavior far easier to reason about and verify. Control over the environment is half the battle.

Frequently Asked Questions

Does a VPN automatically prevent DNS leaks?

Not always. A VPN encrypts your traffic, but DNS queries can still escape through IPv6, WebRTC, or OS resolver settings the VPN doesn't override. Good VPNs push their own DNS and offer leak protection, yet the safest move is to run a leak test yourself and confirm rather than assume.

Can a DNS leak happen even with HTTPS?

Yes. HTTPS encrypts the contents of your connection, but the DNS lookup that resolves the domain name happens first and separately. If that lookup leaks, an observer learns which site you visited even though the page contents stay encrypted. HTTPS and DNS protection solve two different problems.

What's the difference between a DNS leak and an IP leak?

A DNS leak exposes the domains you request by sending lookups outside the tunnel. An IP leak exposes your real IP address, often through WebRTC or IPv6. They sometimes share the same cause, but they reveal different things, so a thorough test checks for both rather than just one.

Why does disabling IPv6 fix so many leaks?

Many VPNs route only IPv4 traffic through the tunnel. If your network supports IPv6 and the VPN ignores it, IPv6 DNS queries travel over your normal connection straight to your ISP. Disabling IPv6 at the OS level removes that escape route entirely, which is why it resolves a large share of leaks.

How often should I test for DNS leaks?

Test after any change that touches your network or VPN setup: switching Wi-Fi, updating your OS, reinstalling the VPN, or changing DNS settings. A single passing test confirms the current state, not future states. Re-testing on new networks, especially public ones, catches leaks before they expose your activity.

Closing the gap for good

A DNS leak is the quiet failure mode of an otherwise working VPN. The encryption holds, the icon says connected, and yet your ISP keeps a running list of the domains you visit. The fix isn't complicated, but it does require you to look. Test your setup, close the IPv6 and WebRTC paths, force the VPN's resolver, and re-test after every change.

The deeper lesson is about trust and control. You can't verify what you can't see, and a leak test turns an assumption into a fact. If you want a setup where the DNS path is yours alone, you can deploy a dedicated VPN server with DediPN: single-tenant OpenVPN with AES-256-GCM, a dedicated IP, and zero logs, from $8 a month. Run the leak test, confirm it's clean, and browse knowing the gap is closed.