What is a DNS leak?

DNS, the Domain Name System, turns a name like example.com into an address like 203.0.113.10 that your device can actually connect to. Your device does not do that translation itself; it asks a resolver, and the resolver it asks is whichever one the network handed out when you connected. On home broadband that is your ISP's resolver.

A VPN is supposed to take over that job. When the tunnel comes up, the VPN app points your device at its own resolver, reachable only inside the tunnel, so your lookups travel encrypted along with everything else. A DNS leak is any lookup that escapes that arrangement and reaches the ISP's resolver, or some other resolver outside the tunnel, carrying your real address as its source.

The consequence is specific. The resolver sees a timestamped list of every domain you look up: not the pages, not the content, but bank.example, clinic.example, dating.example, one after another, tied to your subscriber account. And because websites can see which resolver fetched their records, a site can often work out your real country or city even though your traffic arrives from the VPN's address.

The DNS leak test works by making your browser look up a set of unique hostnames under a DNS zone that we control. Whatever resolvers ask our nameserver for those names are, by definition, the resolvers handling your lookups. The test lists them with their owner and location.

1. Run it once with the VPN off and note the resolver owner. It will usually be your ISP, or a public resolver you set yourself.
2. Turn the VPN on and run it again.
3. Compare. With the VPN on, every resolver should belong to the VPN provider, or sit in the VPN server's country, and your ISP must not appear.

To see what your system resolver is set to right now, the what is my DNS server page shows it without the full test.

One ISP resolver among several VPN resolvers is still a leak. Resolvers are queried in parallel or by turns, and over a day the ISP will see most of your lookups.

• The VPN does not change the system resolver. Typical with manually configured VPNs (built-in OS clients, WireGuard configs without a DNS line, OpenVPN profiles without dhcp-option DNS). The tunnel carries traffic; lookups keep going where they always went.
• Windows asks every interface. Windows can send a lookup over more than one network interface at the same time and use the first answer. With a VPN up, that means the physical adapter's ISP resolver gets a copy. Microsoft calls the behavior Smart Multi-Homed Name Resolution.
• IPv6 is not tunneled. If your ISP provides IPv6 and the VPN only handles IPv4, the IPv6 resolver your ISP advertised remains reachable and the OS happily uses it. The IPv6 test shows whether you have native IPv6.
• The browser has its own DNS. Chrome, Edge and Firefox can send lookups over DNS over HTTPS to a resolver of their own, bypassing whatever the VPN set. That is private from the ISP, but the DoH provider sees your real address if the browser's connection to it is not inside the tunnel.
• The router is the resolver. Many home routers hand out their own address as the DNS server and forward to the ISP. A VPN running on a single device may still have the router as a secondary resolver.
• The tunnel dropped. Without a kill switch, the gap between a disconnect and a reconnect sends everything, lookups included, over the bare connection.

In the VPN app

Start here; it fixes most cases. Look for DNS leak protection, Use VPN DNS only, Block DNS outside the tunnel or similar, and turn on the kill switch. Enable IPv6 leak protection if offered, or set the app to block IPv6 while connected. Re-run the test.

Windows 11

1. Open Settings > Network & internet, select Wi-Fi or Ethernet, then your connection, and choose Hardware properties.
2. Next to DNS server assignment, click Edit, switch Automatic (DHCP) to Manual, turn on IPv4 and enter a resolver you trust, such as 1.1.1.1 and 1.0.0.1. Set DNS over HTTPS to On (automatic template) so the lookups are encrypted even if they escape the tunnel. Do the same under IPv6, or disable IPv6 on the adapter if your VPN cannot carry it.
3. On Pro and Enterprise editions, open the Group Policy Editor and under Computer Configuration > Administrative Templates > Network > DNS Client set Turn off smart multi-homed name resolution to Enabled. This stops Windows from querying the physical adapter while the tunnel is up.

macOS

1. Open System Settings > Network, select Wi-Fi (or Ethernet) and click Details….
2. Open the DNS tab, click + under DNS Servers and add your chosen resolver addresses. Remove the ISP's entries, click OK.
3. Prefer a VPN app that installs its own DNS configuration; macOS will otherwise fall back to the network's resolvers for some lookups.

Android

Use the system-wide Private DNS setting (Settings > Network & internet > Private DNS on Pixel; Settings > Connections > More connection settings > Private DNS on Samsung) and enter a DNS-over-TLS hostname such as one.one.one.one. Lookups are then encrypted to that provider on every network, VPN or not. Our Private DNS guide covers providers and troubleshooting.

Router

If the VPN runs on the router, set the router's WAN DNS servers to the VPN provider's resolvers rather than "obtain automatically from ISP". If the VPN runs on devices, set the router's DNS to a public resolver so that any lookup reaching the router does not reach the ISP's logs.

Browser DNS over HTTPS

Either turn it off so the VPN's resolver is used (Chrome and Edge: Settings > Privacy and security > Security > Use secure DNS; Firefox: Settings > Privacy & Security > DNS over HTTPS), or point it at a provider you trust and accept that the provider, not the VPN, answers your lookups.

After each change, run the DNS leak test again until no resolver outside the VPN appears. Then run the VPN leak test, which checks DNS, WebRTC and IPv6 together. The same misconfigurations that leak DNS, an unhandled IPv6 connection above all, usually leak the other two as well, and a VPN that passes all three is one you can trust on public Wi-Fi. The DNS lookup tool is useful afterwards for checking that your chosen resolver answers correctly and quickly for the sites you use.