Why IPv6 Causes DNS Leaks on Windows
Windows fully supports dual-stack networking, meaning it runs IPv4 and IPv6 simultaneously. When your browser needs to resolve a domain name, Windows can send the DNS query over either protocol — and it often prefers IPv6 when available.
Most VPNs create their encrypted tunnel using IPv4. When the VPN takes control of your IPv4 DNS settings, it routes those queries through the tunnel. But the VPN typically doesn't touch IPv6 at all. Windows continues sending IPv6 DNS queries through your regular ISP connection, completely bypassing the VPN.
This creates a split-brain situation: your IPv4 DNS is secure, but your IPv6 DNS is exposed. Many DNS leak tests only check IPv4, so you might think you're protected when you're not. Use our DNS Leak Checker to test for both IPv4 and IPv6 leaks.
The problem is exacerbated by Windows features like Smart Multi-Homed Name Resolution, which aggressively sends DNS queries through all available interfaces. For more on this, see our Smart Multi-Homed Name Resolution fix guide.
Before You Start: Test for IPv6 DNS Leaks
Before making changes, confirm that IPv6 is actually causing DNS leaks on your system:
- Connect to your VPN
- Visit our DNS Leak Checker
- Run the test and examine the results
- If you see IPv6 addresses (containing colons, like 2001:db8::1) belonging to your ISP, you have an IPv6 DNS leak
Method 1: Disable IPv6 via Network Adapter (Quick Method)
This is the fastest way to disable IPv6 on Windows. It works on both Windows 10 and Windows 11.
Step 1: Open Network Connections
Press Win + R, type ncpa.cpl, and press Enter. This opens the Network Connections window directly, bypassing the Settings app. Alternatively, go to Control Panel → Network and Sharing Center → Change adapter settings.
Step 2: Open Adapter Properties
Right-click on your active network adapter (the one currently connected to the internet — it will be labeled "Wi-Fi" or "Ethernet" and won't have a red X). Select "Properties" from the context menu. If prompted by User Account Control, click "Yes."
Step 3: Uncheck IPv6
In the adapter properties window, you'll see a list of items with checkboxes. Find "Internet Protocol Version 6 (TCP/IPv6)" and uncheck it. Do NOT uncheck "Internet Protocol Version 4 (TCP/IPv4)" — you need that for your internet connection. Click "OK" to apply.
Step 4: Repeat for All Adapters
Important: Repeat this process for every network adapter in the list, including any that are currently disconnected. If you disable IPv6 only on Wi-Fi but leave it enabled on Ethernet, leaks will occur when you plug in a cable. Also disable it on any VPN virtual adapters.
Step 5: Verify
Reconnect your VPN and run our DNS Leak Checker again. You should no longer see any IPv6 DNS servers in the results.
Method 2: Disable IPv6 via Registry (Thorough Method)
The registry method is more thorough because it disables IPv6 at the system level, not just per-adapter. This prevents IPv6 from being re-enabled when new adapters are added or when Windows updates reset adapter settings.
Step 1: Open Registry Editor
Press Win + R, type regedit, and press Enter. Click "Yes" on the User Account Control prompt.
Step 2: Navigate to the Tcpip6 Parameters Key
In the Registry Editor, navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
Step 3: Create the DisabledComponents Value
Right-click on the "Parameters" key in the left panel → New → DWORD (32-bit) Value. Name it DisabledComponents. Double-click the new value and set it to FF (hexadecimal) or 255 (decimal). This completely disables all IPv6 components.
Important: If the "DisabledComponents" value already exists, just modify its data. Don't create a duplicate.
Step 4: Restart Your Computer
The registry change requires a restart to take effect. Save any open work and restart Windows.
Step 5: Verify IPv6 Is Disabled
After restarting, open Command Prompt and run:
ipconfig /all
You should no longer see any IPv6 addresses listed for your network adapters. Then connect your VPN and run our DNS Leak Checker to confirm no IPv6 DNS leaks remain.
Using PowerShell to Disable IPv6 (Advanced)
For advanced users, you can disable IPv6 on all adapters at once using PowerShell. Open PowerShell as Administrator and run:
Get-NetAdapterBinding -ComponentID ms_tcpip6 | Disable-NetAdapterBinding -ComponentID ms_tcpip6
To verify it's disabled:
Get-NetAdapterBinding -ComponentID ms_tcpip6
All adapters should show "Enabled: False" for the IPv6 component.
Combining IPv6 Fix with Other DNS Leak Protections
Disabling IPv6 is one piece of a comprehensive DNS leak prevention strategy on Windows. For complete protection, you should also:
- Change your DNS servers to privacy-focused providers — see our complete Windows DNS leak fix guide
- Disable Smart Multi-Homed Name Resolution to prevent Windows from querying all DNS servers simultaneously
- Flush your DNS cache after making changes
- Enable your VPN's kill switch to prevent leaks during disconnections
- For a broader overview, see our complete IPv6 DNS leak fix guide covering all platforms
When You Don't Want to Disable IPv6
In some cases, you might need IPv6 enabled — for example, if your ISP is IPv6-only, or if specific applications require it. In these cases, the best solution is a VPN that properly tunnels IPv6 traffic through its encrypted connection, preventing leaks without disabling the protocol entirely.
While you can create firewall rules to block IPv6 traffic, this is less reliable than disabling IPv6 at the adapter or registry level. Firewall rules can be bypassed by certain system processes, and DNS queries might still leak before the firewall processes them.