What Is a DNS Leak and Why It Ruins Your VPN
You turned on the VPN. The little lock icon appeared. You think you're private. But there's a specific, common failure mode where your DNS queries — every domain name your device looks up — leak outside the VPN tunnel to your ISP's resolver. Your ISP still knows exactly which sites you're visiting. The VPN lied to you, or at least didn't deliver what you thought you bought.
Why DNS Leaks Happen
A DNS leak happens when your operating system sends DNS queries through the regular network stack instead of routing them through the VPN tunnel. This can happen because the VPN client didn't properly override the system's DNS settings, because Windows' Smart Multi-Homed Name Resolution feature sends queries to multiple resolvers simultaneously and uses whichever responds first, or because certain applications bypass the system resolver entirely.
On Windows, this is a chronic problem. The OS was built to be helpful with DNS resolution, and 'helpful' in this context means 'sends queries wherever it thinks is fastest.' VPN software has to actively fight this tendency. Not all of it does a good job.
What a DNS Leak Actually Exposes
When your DNS queries leak to your ISP's resolver, your ISP gets a timestamped list of every domain you've looked up. Not the full URLs — just the domains. But that's enough to know you visited a medical information site, a job board, a political news outlet, or an adult site. The domain alone tells a story.
But here's the real problem: the IP address on your traffic is hidden by the VPN. But DNS leaks mean your browsing profile is fully visible anyway, just through a different channel. You've encrypted your front door and left the back window open.
How to Test for a DNS Leak
Running a DNS leak test is simple — tools like ours send queries to test servers and check which resolver answers. If the resolver belongs to your ISP or a company in your country when you're connected to a VPN in a different country, you have a leak. The test takes about 15 seconds and gives you a clear yes or no.
Fixing It
Most quality VPN clients have a DNS leak protection setting — enable it. Manually set your DNS servers to ones operated by or associated with your VPN provider. On Windows, you can disable Smart Multi-Homed Name Resolution through Group Policy. On Linux, using systemd-resolved with the VPN's DNS pushed correctly usually handles it cleanly. Test again after each change — don't assume it worked.
The IPv6 DNS Leak Problem
Most DNS leak guides focus on IPv4. But if your device has an IPv6 address and your VPN doesn't route IPv6 traffic through the tunnel, your IPv6 DNS queries leak to your ISP's resolver regardless of what your IPv4 DNS settings say. This is a common oversight — many VPN clients handle IPv4 DNS correctly but ignore IPv6 entirely.
The fix is either disabling IPv6 entirely while connected to the VPN (brute force but effective), ensuring your VPN client explicitly routes IPv6 through the tunnel, or using a VPN provider that blocks IPv6 at the client level. Check your VPN's documentation for IPv6 support. If it doesn't mention IPv6 DNS handling at all, that's usually a bad sign. A good DNS leak test tool checks for IPv6 leaks specifically — not just IPv4.
Check for DNS Leaks Now
Find out in 15 seconds whether your DNS queries are leaking outside your VPN tunnel.
Run DNS Leak TestAbout Kunal Khatri
Kunal is a network security specialist and systems administrator with 8+ years of experience auditing secure connections and building network infrastructure.
Related Articles
How to Check if Your DNS Is Actually Secure
Most people use whatever DNS their ISP assigned them without thinking about it. That default often exposes your browsing history, allows manipulation, and has no privacy protections whatsoever.
DNSSEC: Making DNS Trustworthy (Finally)
DNS has no built-in authentication — any resolver can lie to you. DNSSEC adds cryptographic signatures to prevent that. Adoption is growing. It's not enough yet.
MX Records: How Email Routing Actually Works
When you send an email, the routing decision happens through MX records in DNS. Understanding this explains delivery failures, spam problems, and how to set up email correctly.
What Is a Reverse DNS Lookup and Who Uses It
Forward DNS goes from domain name to IP. Reverse DNS goes the other way — and the uses range from spam filtering to server identification to network diagnostics.