A DNS leak happens when your device sends DNS lookups outside your VPN tunnel, usually to your internet provider. Your VPN hides your traffic, but your ISP can still see the name of every site you visit.
How DNS works
When you type a site name, your device asks a DNS server for that site’s IP address. Normally your ISP runs that DNS server. With a VPN, those questions should go through the tunnel to the VPN’s own DNS servers.
What causes a DNS leak?
- Custom DNS settings on your device or router that the VPN does not override.
- Windows “smart” DNS behavior that sends lookups to every network adapter at once.
- IPv6 DNS requests that go outside a VPN that only tunnels IPv4.
- Split tunneling that sends some apps outside the VPN.
- VPN reconnects without a kill switch.
- Browser secure DNS (DNS over HTTPS) sending lookups to a provider you did not choose. This is not a leak to your ISP, but your VPN no longer handles DNS.
How to tell if you have a DNS leak
A DNS leak test makes your browser look up random, unique names and records which DNS servers ask for them. If any server belongs to your ISP instead of your VPN, you have a leak. Our DNS leak test is coming soon. Meanwhile, run the VPN leak test to check your IP, IPv6 and WebRTC.
How to fix a DNS leak
- Turn on DNS leak protection in your VPN app, if it has the option.
- Remove custom DNS servers from the VPN app and your network settings.
- Turn on the kill switch.
- Turn on IPv6 leak protection, or disable IPv6.
- If your browser uses secure DNS, either turn it off so the VPN handles DNS, or choose a provider you trust.
Do all VPNs prevent DNS leaks?
Most well-known VPNs run their own DNS servers and protect against DNS leaks by default. Leaks usually come from device settings, not the VPN itself. Testing is the only way to be sure.