What Is a DNS Leak and How Does It Affect ExpressVPN Users?
Every time you type a website address into your browser, your device sends a DNS query to translate that domain name into a numerical IP address. By default, these queries are handled by your ISP's DNS servers, which means your internet provider has a complete record of every website you visit — timestamped and tied to your account. DNS is one of the most revealing pieces of metadata your device generates, and it travels unencrypted unless specifically protected.
When you connect to ExpressVPN, all your DNS queries should be routed through ExpressVPN's own private DNS servers, which are built into every VPN server in their network. A DNS leak occurs when some or all of those queries escape the encrypted VPN tunnel and are sent directly to your ISP's DNS instead. From your perspective, ExpressVPN appears to be connected and working — but your ISP can still see every website you visit in real time.
ExpressVPN users specifically experience DNS leaks in several scenarios. The most common is related to the Lightway protocol's fast reconnection behaviour — when switching networks (e.g., from Wi-Fi to mobile data), there can be a brief moment where DNS queries are sent before the tunnel is fully re-established. IPv6 handling is another frequent cause: if your ISP assigns you an IPv6 address and ExpressVPN's tunnel only covers IPv4 traffic, your IPv6 DNS queries can leak outside the tunnel entirely. Manual DNS configurations on your device that override ExpressVPN's settings are also a common culprit.
The users most at risk are those who frequently switch between Wi-Fi networks — such as laptop users moving between home, office, and public hotspots — as each network transition creates a brief vulnerability window. Users who have configured custom DNS servers in their operating system settings (like Google DNS 8.8.8.8 or Cloudflare 1.1.1.1) are also at high risk, because these settings can take priority over ExpressVPN's DNS routing on certain platforms. Additionally, users running older ExpressVPN client versions that predate improvements to their DNS leak prevention may have unpatched vulnerabilities.
Testing regularly is essential because DNS leaks are silent — there is no warning, no notification, and no visible change in the ExpressVPN interface when a leak occurs. Your VPN status will show as "Connected" and your IP address may be properly masked, while your DNS queries are simultaneously being sent to your ISP in plain text. The test above takes 10 seconds and gives you a definitive answer on whether ExpressVPN is correctly handling your DNS traffic right now.
Does ExpressVPN Protect Against DNS Leaks?
ExpressVPN runs its own private zero-knowledge DNS on every server in their global network. When you connect to any ExpressVPN server, your DNS queries are resolved locally on that server without being sent to any third-party DNS provider. This means your browsing activity is never exposed to Google, Cloudflare, or your ISP's DNS infrastructure — the entire DNS resolution process happens within the encrypted tunnel on the server you're connected to.
Network Lock is ExpressVPN's kill switch feature, and it serves as the primary defence against DNS leaks during connection interruptions. When enabled, Network Lock blocks all internet traffic — including DNS queries — if the VPN connection drops for any reason. This prevents the brief window of exposure that occurs when your device falls back to your ISP's DNS during a reconnection. Network Lock is enabled by default on ExpressVPN's desktop clients, but you should verify it is active in your settings.
The Lightway protocol, ExpressVPN's proprietary VPN protocol, handles DNS routing more tightly than older protocols like OpenVPN or IKEv2. Lightway establishes connections in under a second and recovers from network changes almost instantly, which significantly reduces the window during which DNS leaks could occur. Its lightweight codebase has also been independently audited, and the DNS handling implementation was specifically reviewed for leak vulnerabilities. For maximum leak protection, Lightway (UDP) is the recommended protocol setting.
Despite these protections, leaks can still occur in specific edge cases. If you have manually configured DNS servers on your device (such as Google 8.8.8.8), those settings may override ExpressVPN's DNS on certain operating systems. Browser-level DNS-over-HTTPS settings in Chrome, Firefox, or Edge can also bypass the VPN tunnel entirely, sending DNS queries directly to Cloudflare or Google regardless of your VPN connection. And if Network Lock is disabled — either intentionally or through a software update that reset your settings — any brief disconnection will expose your DNS to your ISP.
How to Fix an ExpressVPN DNS Leak – Step by Step
- 1
Confirm the Leak Using the Test Above
Run the DNS leak test at the top of this page while connected to ExpressVPN. If the DNS server shown matches your ISP rather than ExpressVPN, you have a confirmed DNS leak. Run the test on multiple servers and networks to determine whether the leak is consistent or isolated to a specific configuration.
- 2
Update ExpressVPN to the Latest Version
Older ExpressVPN client versions may have DNS handling issues that have been resolved in newer releases. Open ExpressVPN, click the hamburger menu, and check for updates — or download the latest version from expressvpn.com. ExpressVPN frequently releases patches that improve DNS leak protection, especially on Windows.
- 3
Enable Network Lock (ExpressVPN's Kill Switch)
Open ExpressVPN, go to Settings → General, and ensure Network Lock is enabled. Network Lock blocks all traffic if the VPN drops, preventing DNS queries from leaking to your ISP during reconnections. On macOS, the setting may be under Preferences → General. On mobile, look for Network Protection.
- 4
Switch Protocol to Lightway (UDP or TCP)
Go to ExpressVPN Settings → Protocol and select Lightway (UDP) for the best combination of speed and leak protection. If Lightway UDP is unstable on your network, try Lightway TCP. Avoid using OpenVPN or IKEv2 unless Lightway is unavailable, as Lightway has the most robust DNS routing implementation.
- 5
Try a Different ExpressVPN Server Location
The server you're connected to may have a temporary configuration issue. Disconnect, select a different server location, reconnect, and re-run the DNS leak test. Try servers in different countries to determine whether the leak is server-specific or affecting your connection globally.
- 6
Reset Device DNS Settings to Automatic
Open your device's network settings and check if you have manually configured DNS servers. On Windows: Settings → Network → Adapter → IPv4 Properties → set DNS to Automatic. On macOS: System Settings → Network → DNS → remove manual entries. Custom DNS settings often override ExpressVPN's private DNS routing.
- 7
Disable Any Browser DNS-over-HTTPS Overrides
Modern browsers can send DNS queries directly to Cloudflare or Google via DNS-over-HTTPS, completely bypassing your VPN's DNS. In Chrome: Settings → Privacy → Security → disable 'Use secure DNS'. In Firefox: Settings → Privacy → DNS over HTTPS → set to Off. This ensures your browser uses ExpressVPN's DNS instead of its own.
- 8
Reinstall ExpressVPN and Test Again
If the leak persists after all other steps, uninstall ExpressVPN completely, restart your device, download a fresh copy from expressvpn.com, install it, and reconnect. A clean installation removes any corrupted configuration files or outdated network adapter settings that may be causing the persistent DNS leak.
A DNS leak exposes the websites you visit to your ISP because your DNS queries bypass the VPN tunnel and are resolved by your ISP's servers instead of ExpressVPN's private DNS. An IP leak directly exposes your real IP address to websites and services, meaning they can see your actual location and identity. A WebRTC leak occurs at the browser level — JavaScript APIs can expose your real IP through WebRTC regardless of your VPN connection. All three are distinct privacy failures that can occur independently. You should test for all three regularly.
Not sure if your DNS is leaking? Find out in seconds.