What is a DNS leak and how to prevent it?
TL;DR, the essentials
- A DNS leak happens when your DNS queries go to your internet provider’s resolver instead of travelling through the VPN tunnel.
- The result: your VPN hides your IP address, but your ISP can still see the list of sites you visit. Your privacy is broken and nothing warns you.
- Test it in 10 seconds on a DNS leak test site. To stay protected: use the VPN’s own DNS, turn on its built-in leak protection and the kill switch.
You launch your VPN, the icon turns green, and you assume you are browsing away from prying eyes. Yet a DNS leak can quietly reveal every site you visit to your internet provider, VPN on or off. It is one of the sneakiest weaknesses for everyday users, because it triggers no visible alert. Here is what a DNS leak is, why it can expose your activity despite the encrypted tunnel, how to test for it in seconds and, above all, how to protect yourself.
What exactly is a DNS leak?
Check it right now
Before hunting for a DNS leak, check which address you are going out through: our what is my IP tool answers in a second, and the reverse hostname gives the VPN provider away.
To understand the leak, you first need to understand DNS (Domain Name System). It is the internet’s phone book: every time you type mistersoftware.com, your device asks a DNS resolver to translate that name into a numeric IP address. Without that translation, the site is unreachable. The catch: those DNS queries carry, in plain text, the list of domain names you look up.
When a VPN works correctly, these DNS queries travel inside the encrypted tunnel and are resolved by the VPN provider’s DNS servers. A DNS leak is when those queries escape the tunnel and go straight to your ISP’s resolver. The rest of your traffic still flows through the VPN, but your DNS queries take the back door. Here is what happens, step by step.
You type an address
Your browser needs to turn the domain name into an IP address, so it sends a DNS query. Normally this query should enter the VPN tunnel like all your other traffic.
The query leaves the tunnel
Because of a system misconfiguration, a network switch or a hard-coded DNS, the query bypasses the VPN and heads to your provider’s DNS resolver, outside the encryption.
Your ISP logs the visit
The ISP resolver sees the domain name, timestamps it and can log it. Your IP is hidden by the VPN, but the list of your sites is exposed. The leak is invisible to you.
The picture to remember
A VPN encrypts the contents of your letter, but a DNS leak is like writing the recipient’s address in the open on the envelope. Nobody reads the letter, but they know who you are writing to. To revisit how the tunnel works, our guide “what does a VPN do” covers the basics.
Why a DNS leak happens even with a VPN on
Here is the counter-intuitive part: the tunnel can be perfectly encrypted and the leak can still exist. Several common causes explain why a DNS query escapes despite an active VPN:
- The system keeps its default DNS. On Windows in particular, the OS can keep sending queries to the ISP resolver if the VPN does not force its own DNS.
- An abrupt network change. Waking from sleep, switching Wi-Fi to mobile data, reconnecting: for a few seconds the device can fall back on the original network settings.
- A router’s “smart DNS” or transparent resolution, which reroutes some queries outside the tunnel.
- Windows and its “Smart Multi-Homed Name Resolution”, which sends queries to several resolvers in parallel for speed, including the ISP’s.
- An IPv6 leak. If the VPN only handles IPv4 and your connection uses IPv6, the IPv6 traffic (DNS included) can exit unprotected.
The false sense of security trap
A DNS leak shows no error. Your VPN looks like it is working, and your IP is correctly hidden on the usual IP-checking sites. Only a dedicated DNS leak test reveals the problem. That is why you have to check for it on purpose.
What a DNS leak really reveals about you
In practice, a DNS leak cancels much of a VPN’s privacy value. Your internet provider (and any entity that controls the resolver in use) can reconstruct:
- The list of domains you visit, with the time and frequency.
- A browsing profile usable for statistics, advertising, or handed over on request.
- Your approximate location, because your ISP’s DNS gives away your region even while the VPN claims to place you abroad. A real problem if you were counting on the VPN to get around a geo restriction.
A VPN that hides your IP but leaks your DNS protects the envelope, not the address book. It is half a VPN.
Want a VPN that does not leak?
Our comparison only keeps VPNs with built-in DNS leak protection, tested in real conditions.
How to test for a DNS leak in 10 seconds
Good news: spotting a leak is simple and free. A DNS leak test works by showing which DNS servers are resolving your queries. If they belong to your internet provider rather than your VPN, you have a leak.
Connect your VPN
Turn on your VPN and pick a server in a different country from your own. That contrast is what makes a leak obvious in the next step.
Run a DNS leak test
Open a trusted tool such as dnsleaktest.com, browserleaks.com/dns or the tester built into some VPNs. Run the extended test.
Read the results
Look at the provider name and country of the DNS servers shown. If they match your VPN and the server country you chose, you are fine. If they show your ISP’s name or your real country, you have a leak.
Good habit
Run the test again after every network or server change, and once right after installing a new VPN. Five minutes of checking beats months of exposed browsing.
Quick quiz
What does a DNS leak reveal to your internet provider, even with the VPN on?
How do you protect yourself from a DNS leak?
The fix comes down to one principle: force all your DNS queries through the tunnel and have them resolved by trusted servers. Here are the concrete measures, from simplest to most technical.
- Choose a VPN with built-in DNS leak protection. Serious providers run their own DNS servers and force every query through them. It is the most effective protection, and it is automatic.
- Enable the kill switch. If the tunnel drops, this feature cuts all connectivity and stops any query (DNS included) from leaking in plain text during reconnection.
- Block or let the VPN manage IPv6. A good client disables IPv6 or routes it through the tunnel to avoid leaking via that channel.
- Verify afterwards with a DNS leak test. Trust is good; proof is better.
The feature that makes the difference
A VPN that hosts its own DNS servers and forces their use solves the problem at the root. It is a criterion in its own right when comparing providers, right alongside an audited no-logs policy or a kill switch.
Ready to pick a leak-free VPN?
We tested DNS protection, the kill switch and the logging policy of the best offers around.
IPv6 and WebRTC leaks: the DNS leak’s cousins
The DNS leak does not travel alone. Two other leaks can give away your real network identity despite the VPN, and it is worth testing them at the same time:
- The IPv6 leak. Many connections use IPv6. If the VPN only supports IPv4, your real IPv6 address can exit in the clear. A good VPN disables or tunnels IPv6.
- The WebRTC leak. A browser feature (used for video calls) can reveal your real IP to a website even with the VPN on. It is fixed on the browser side (an extension or a setting) and through the protections built into some VPN clients.
Tools like browserleaks.com test DNS, IPv6 and WebRTC in one go. A serious consumer VPN covers all three, but a manual check is the only way to be sure. And a useful reminder: even with zero leaks, a VPN does not make you anonymous. If you are signed in to your Google account or a social network, the site knows who you are, leak-proof DNS or not.
The next step
Want a VPN whose DNS protection actually holds up? Check out our best VPNs of 2026 comparison, or go back to basics with “what does a VPN do”.
Frequently asked questions
What is a DNS leak in plain terms?
A DNS leak happens when your DNS queries, which translate site names into IP addresses, leave the VPN tunnel and go to your internet provider’s resolver. As a result, your VPN still hides your IP address, but your ISP can see the list of sites you visit.
How do I test for a DNS leak?
Connect your VPN to a server in another country, then open a tool like dnsleaktest.com or browserleaks.com/dns and run the extended test. Look at the name and country of the DNS servers shown: if they match your VPN, you are fine; if they show your internet provider or your real country, you have a leak.
Is a DNS leak dangerous?
It does not directly endanger your passwords, but it cancels much of the privacy you expect from a VPN: your internet provider can rebuild the list of sites you visit and your real location. For anyone using a VPN to protect their privacy, that is a real problem.
How do I prevent a DNS leak?
Use a VPN that runs its own DNS servers and forces every query through them, enable the kill switch to cut the connection if the tunnel drops, and let the client manage or disable IPv6. Then verify with a DNS leak test after every network or server change.
Does a good VPN really prevent DNS leaks?
Serious consumer VPNs include active DNS leak protection by default and host their own resolvers. But no protection is guaranteed 100% depending on your system setup: a manual test is the only way to be certain. And even without a leak, a VPN does not make you anonymous if you stay signed in to your accounts.