What Is a DNS Leak — And How to Stop One
docA DNS leak can expose your browsing even when your VPN is on. Learn how DNS leaks happen, how to detect them, and how to fix them for real.
A DNS leak is not a break in the encryption. It is a routing decision: your device asks a resolver you did not choose — usually the one belonging to your ISP or your local network — to translate a hostname into an address, and that resolver logs the question. The traffic that follows may be perfectly encrypted. The record of where you were going is not.
Why DNS is the weak point
DNS was designed in an era when the network was trusted. Queries travel over UDP port 53 in plaintext. Anyone on the path — the router, the ISP, a captive portal — can read them and, in some configurations, modify the answers.
A VPN is built to tunnel IP packets. Whether it also tunnels DNS depends entirely on how the client is configured, and there are three common failure points:
- The operating system keeps its own resolver list. The VPN adapter is added, but the existing DNS servers are not replaced. Queries go to the adapter that has priority, which is often the physical one.
- Split tunnelling routes around the tunnel. If only certain traffic is routed through the VPN, DNS resolution for everything else can go direct.
- IPv6 resolves separately. Many VPN clients are IPv4-only. If the network hands out an IPv6 DNS server, that path stays outside the tunnel even when IPv4 is fully covered.
How a leak test actually works
The mechanics are simpler than most people expect. The test issues lookups for a set of unique, per-session subdomains. Each subdomain is answered by a resolver that records which address asked for it. If the answer comes back from your VPN provider's resolver, the tunnel is working. If it comes back from your ISP, the request escaped.
The result is not a pass or fail. It is a list, and the list tells you where the queries went:
| What the result shows | Interpretation |
|---|---|
| Only the VPN provider's resolvers | DNS is fully tunnelled. No leak. |
| Your ISP's resolvers alongside the VPN's | Partial leak. Some queries bypass the tunnel, usually through a second network interface. |
| Your home router's address, such as 192.168.1.1 | The router is acting as a forwarder. It may relay to your ISP, so the ultimate resolver is still outside the tunnel. |
| A resolver you have never heard of, in another country | Either a misconfigured VPN exit or a hijack. Worth investigating. |
| Nothing reported at all | The test could not complete its lookups — likely blocked, not secure. |
What a leak actually reveals
The usual argument is "DNS only shows domains, and the traffic is encrypted anyway". That undersells the problem in three ways:
- Domain names are content. The hostname in a query is often more revealing than the payload: a medical subdomain, a specific ticketing page, an internal system name.
- Queries are linkable. A resolver sees a sequence, not isolated lookups. The order and timing reconstruct a browsing session, including which pages were visited on a shared domain.
- It defeats the point of the VPN. The purpose is to stop your provider from knowing where you go. A DNS leak hands that back one layer below the encryption.
Fixing it, in order of reliability
- Check whether the VPN client has a DNS switch. Many do, often labelled "DNS leak protection" or "force DNS through tunnel". Enable it, then re-test — do not trust the label.
- Set DNS explicitly to the tunnel. Point the system resolver at the VPN provider's DNS address, not at a public resolver, and confirm the VPN adapter is the one carrying it.
- Disable IPv6 DNS or tunnel it. If the provider does not support IPv6, turning IPv6 off on the adapter removes an entire leak path. If it does support it, make sure the DNS server sits inside the tunnel.
- Use encrypted resolution. DNS over HTTPS on port 443, or DNS over TLS on port 853, hides queries from the local network. It does not hide them from the resolver operator — it moves the trust, it does not remove it.
- Block port 53 outbound. A firewall rule that drops plaintext DNS except to the intended resolver forces every application onto the approved path, including ones that ignore system settings.
Test the right thing
Run the check three times, because a single pass proves very little:
- Directly, with no VPN — establishes your baseline resolver.
- With the VPN connected, immediately after connecting.
- With the VPN connected, after ten minutes of normal browsing — leaks often appear only when a second interface wakes up, such as Wi-Fi reconnecting or a hotspot switching.
The third case is where most partial leaks show up, and it is the one almost nobody tests.
FAQ
Is a DNS leak illegal to fix?
No. Configuring your own resolver or encrypting DNS is ordinary network administration.
Does a DNS leak reveal my IP address?
Not directly, but the resolver sees the source address of the query. If that address is your real one, the leak reveals both the domain and your location.
Does using a public resolver prevent leaks?
It changes who sees the queries, not whether the tunnel is bypassed. If the public resolver is reachable outside the VPN, you have simply moved the leak.
Why does the test show several resolvers?
Because devices often have more than one network path — Ethernet, Wi-Fi, a virtual adapter, IPv4 and IPv6. Each can resolve independently. Multiple resolvers in the result is the signature of a partial leak.
Is a leak the same as DNS hijacking?
No. A leak means your query went somewhere you did not intend. Hijacking means the answer was changed. The first is a routing problem; the second is an attack.