What Is a DNS Leak and Why Do NordVPN Users Experience Them?
Every time you visit a website, your device sends a DNS (Domain Name System) query to translate the domain name — like google.com — into an IP address that your browser can connect to. These queries are sent in plain text by default, which means your ISP can see every single website you visit. DNS is essentially a log of your entire browsing history, transmitted to your ISP in real time without any encryption.
NordVPN is designed to route all DNS queries through its own private DNS servers, which are co-located on every VPN server in their network. When working correctly, your ISP never sees your DNS queries — they're encrypted within the VPN tunnel and resolved by NordVPN's servers. A DNS leak occurs when those queries bypass the VPN tunnel and go directly to your ISP's DNS servers instead, exposing your browsing activity despite your VPN connection showing as active.
The most common causes of DNS leaks with NordVPN are misconfigured split tunneling — where excluded apps send DNS queries outside the tunnel — using manual DNS settings in your operating system that override NordVPN's DNS configuration, switching between VPN servers too quickly before the previous connection has fully closed, or running an older NordVPN client version that has known DNS handling vulnerabilities that have since been patched.
NordVPN users most affected by DNS leaks are those on Windows who have manually configured DNS servers in their network adapter settings outside of the NordVPN app, users who have enabled DNS-over-HTTPS (DoH) in their browser settings which conflicts with NordVPN's DNS routing, and users running older NordVPN client versions that predate improvements to their DNS leak protection implementation. macOS and Linux users can also experience leaks if their system resolver is configured to bypass the VPN.
Even a brief DNS leak can expose your complete browsing history to your ISP during the time the leak is active. Your ISP can log which websites you visited, when you visited them, and how often — regardless of whether your IP address was masked by NordVPN. The test above takes 10 seconds and gives you a definitive answer on whether NordVPN is correctly handling your DNS traffic right now. We recommend running it every time you connect to a new network.
Does NordVPN Have DNS Leak Protection?
NordVPN operates its own private zero-logging DNS servers on every server in their network — over 6,000 servers across 111 countries. When you connect to any NordVPN server, all DNS queries are automatically routed exclusively through these private servers. Your ISP never handles your DNS requests, which means they cannot see which websites you visit. NordVPN does not use third-party DNS providers, maintaining full control over the entire DNS resolution chain.
NordVPN also includes Threat Protection, which operates at the DNS level to block connections to known malicious domains, phishing sites, and ad trackers before they load. This adds an additional layer of privacy beyond standard DNS leak prevention — not only are your DNS queries hidden from your ISP, but dangerous DNS requests are intercepted and blocked before your browser ever makes the connection.
Despite these robust protections, leaks can still occur in specific scenarios that override NordVPN's default behaviour. The most common is split tunneling — if you have excluded certain apps from the VPN tunnel, their DNS queries may also be excluded and sent directly to your ISP's DNS servers. Similarly, if you've manually set DNS servers in your operating system's network settings, those settings may take priority over NordVPN's DNS configuration on certain platforms.
NordVPN's kill switch is a critical companion feature that blocks all internet traffic — including DNS queries — if the VPN connection drops unexpectedly. Without the kill switch enabled, a brief disconnection can expose both your real IP address and your DNS queries to your ISP before NordVPN reconnects. The kill switch is available on all platforms but is disabled by default on most — you need to enable it manually in NordVPN's settings.
How to Fix a NordVPN DNS Leak – Step by Step
- 1
Confirm the Leak Using the Test Above
Run the DNS leak test at the top of this page while connected to NordVPN. If the DNS server shown matches your ISP rather than NordVPN, you have a confirmed DNS leak. Run the test on multiple servers and networks to determine whether the leak is consistent or limited to a specific configuration.
- 2
Update NordVPN to the Latest Client Version
Older NordVPN client versions may have DNS handling vulnerabilities that have been fixed in newer releases. Open NordVPN, go to Settings, and check for updates — or download the latest version directly from nordvpn.com. A clean reinstall is more reliable than an in-place update for resolving persistent leak issues.
- 3
Enable the NordVPN Kill Switch
Open NordVPN Settings and enable the Internet Kill Switch. This blocks all traffic if the VPN drops, preventing DNS queries from leaking to your ISP during reconnections. On Windows, also consider enabling the App Kill Switch for browsers specifically.
- 4
Disable Split Tunneling or Review Excluded Apps
If you're using NordVPN's split tunneling feature, check which apps are excluded from the VPN tunnel. Excluded apps send their DNS queries directly to your ISP. Either disable split tunneling entirely or ensure your browser is not in the excluded list.
- 5
Switch NordVPN Protocol (Try NordLynx vs OpenVPN)
Go to NordVPN Settings → Connection → Protocol. Try switching between NordLynx (WireGuard-based) and OpenVPN. NordLynx generally has more reliable DNS routing on modern systems, but OpenVPN may perform better on some networks. Re-run the leak test after switching.
- 6
Check Your Device DNS Settings and Set to Automatic
Open your device's network settings and check if you have manually configured DNS servers. On Windows: Network Settings → Adapter → IPv4 Properties. On macOS: System Settings → Network → DNS. Set DNS to 'Automatic' or remove manually configured servers so NordVPN's DNS takes priority.
- 7
Disable Browser-Level DNS-over-HTTPS
Chrome, Firefox, and Edge all have optional DNS-over-HTTPS (DoH) settings that can bypass your VPN's DNS routing. In Chrome: Settings → Privacy → Security → Use secure DNS. In Firefox: Settings → Privacy → DNS over HTTPS. Disable these settings so your browser uses NordVPN's DNS instead.
- 8
Disconnect, Restart NordVPN, Reconnect, and Re-test
Disconnect from NordVPN completely, close the app, wait 10 seconds, reopen it, and connect to a new server. Then re-run the DNS leak test above. A fresh connection clears any cached DNS configurations that may have caused the initial leak.
Open the NordVPN app and go to Settings. Look for 'Kill Switch' or 'Internet Kill Switch' — it should show as enabled (toggled on). On Windows, NordVPN offers two kill switch modes: the regular kill switch that activates when the VPN drops, and the app kill switch that closes specific apps if the VPN disconnects. On macOS and mobile, there is a single kill switch toggle. If you cannot find the setting, update your NordVPN client to the latest version.
Not sure if your DNS is leaking? Find out in seconds.