What Is a DNS Leak and How Does It Affect ProtonVPN Users?
The Domain Name System translates human-readable domain names into IP addresses every time you visit a website. By default, these DNS queries are handled by your ISP's resolvers and transmitted in plain text, giving your internet provider a complete, timestamped record of every site you visit. For privacy-conscious users who chose ProtonVPN specifically to avoid this kind of surveillance, a DNS leak represents a fundamental failure of the protection they're relying on — their browsing history is exposed to exactly the entity they're trying to hide it from.
A DNS leak occurs when your DNS queries bypass ProtonVPN's encrypted tunnel and are sent directly to your ISP's DNS servers instead. ProtonVPN's interface will show a connected status, your IP address will be masked, and your traffic will appear encrypted — but your ISP can still see a complete list of every domain you resolve. This is particularly concerning for ProtonVPN's user base, which tends to have higher privacy requirements than average VPN users and may be relying on the VPN for sensitive communications, journalism, or activism.
ProtonVPN users who enable Secure Core — ProtonVPN's multi-hop architecture that routes traffic through hardened servers in Switzerland, Iceland, or Sweden before reaching the exit server — often assume this provides complete DNS protection. While Secure Core does add an additional routing layer, it cannot prevent DNS leaks caused by device-level misconfigurations. If your operating system or browser is configured to send DNS queries outside the VPN tunnel, those queries bypass both the exit server and the Secure Core server entirely. Secure Core protects against compromised exit servers, not against local DNS misrouting.
Specific ProtonVPN configurations that create leak risk include using custom DNS servers in ProtonVPN's advanced settings (which can route queries outside the tunnel depending on the implementation), enabling split tunneling that excludes browsers or system-level network services, and running the free tier on servers with high load (which can cause connection drops that briefly expose DNS). Users who switch between WireGuard and OpenVPN protocols may also experience different DNS behaviour on the same network, as each protocol handles DNS routing differently at the system level.
Even the most carefully configured privacy setup needs to be verified, not assumed. ProtonVPN's open-source clients and published audit reports demonstrate a genuine commitment to transparency — but transparency about code does not guarantee leak-free operation on your specific device, network, and configuration. Operating system updates, browser changes, network environment shifts, and even ProtonVPN client updates can all introduce DNS leaks without any visible warning. The test above takes 10 seconds and provides a definitive answer about whether ProtonVPN is correctly handling your DNS queries right now.
Does ProtonVPN Protect Against DNS Leaks?
ProtonVPN operates its own private DNS servers on every VPN server in their network. When you connect to any ProtonVPN server, all DNS queries are resolved locally on that server within the encrypted tunnel — your ISP's DNS infrastructure is never contacted. ProtonVPN does not use third-party DNS providers for resolution, meaning no external party (Google, Cloudflare, or otherwise) can see or log your DNS queries. This private DNS architecture is consistent across all subscription tiers, including the free plan.
ProtonVPN's Secure Core architecture adds a second layer of protection for users who need it. When Secure Core is enabled, your traffic passes through a hardened server in Switzerland, Iceland, or Sweden before reaching the exit server in your chosen country. This means DNS queries pass through two VPN servers, making it significantly harder for any single point of compromise to expose your browsing activity. Secure Core servers are located in high-security data centres with full disk encryption and are operated exclusively by Proton's own team — not rented from third-party hosting providers.
NetShield, ProtonVPN's DNS-level filtering feature, provides an additional privacy layer on paid plans. Operating at three levels — malware blocking, ad blocking, and tracker blocking — NetShield intercepts DNS queries within the tunnel and prevents connections to known malicious or tracking domains. NetShield's functionality also serves as an indirect verification that your DNS is correctly routed through ProtonVPN: if ads and trackers are being blocked, your DNS queries are definitively passing through ProtonVPN's servers. If you notice NetShield suddenly stops blocking ads, it may indicate a DNS leak has occurred.
ProtonVPN's clients are fully open-source and have undergone independent security audits by Securitum, with results published on Proton's blog. These audits specifically examined DNS handling, kill switch implementation, and tunnel integrity. Despite this rigorous approach, edge cases remain where DNS leaks can occur: custom DNS configurations that override ProtonVPN's settings, browser-level DNS-over-HTTPS that bypasses the tunnel, IPv6 queries on networks where ProtonVPN's tunnel only covers IPv4, and brief connection drops when the kill switch is disabled. The open-source nature of the clients means these edge cases are documented and tracked in public issue trackers, but they still require user-side configuration to prevent.
How to Fix a ProtonVPN DNS Leak – Step by Step
- 1
Confirm the Leak Using the Test Above
Run the DNS leak test at the top of this page while connected to ProtonVPN. If the DNS server shown matches your ISP rather than ProtonVPN, you have a confirmed leak. Run the test on multiple ProtonVPN servers — including Secure Core servers — and from multiple devices to determine whether the leak is consistent or isolated to a specific configuration.
- 2
Update ProtonVPN to the Latest Client Version
ProtonVPN's open-source clients receive regular updates that improve DNS routing and fix known leak vulnerabilities. Check for updates within the app or download the latest version from protonvpn.com. Pay attention to the changelog — DNS leak fixes are explicitly documented in ProtonVPN's release notes, so you can verify whether a known issue affecting your platform has been patched.
- 3
Enable ProtonVPN Kill Switch (Permanent or Non-Permanent)
ProtonVPN offers two kill switch modes: the standard kill switch that activates only when a VPN connection drops, and the permanent kill switch that blocks all non-VPN traffic even when ProtonVPN is disconnected. For maximum DNS leak protection, enable the permanent kill switch in Settings → Connection. This ensures your device can never send DNS queries outside the VPN tunnel, even if the client crashes or is closed accidentally.
- 4
Check if Custom DNS Settings Are Overriding ProtonVPN's DNS
ProtonVPN's advanced settings allow you to configure custom DNS servers. If you have set a custom DNS (such as Quad9 or Cloudflare), those queries may route outside the VPN tunnel depending on your platform. Go to ProtonVPN Settings → Connection → DNS and ensure it is set to the default ProtonVPN DNS. Also check your operating system's DNS settings — custom system-level DNS can override ProtonVPN's configuration.
- 5
Disable Split Tunneling or Review Included/Excluded Apps
If you're using ProtonVPN's split tunneling feature, verify which apps are included or excluded from the VPN tunnel. Excluded apps send all traffic — including DNS queries — outside the tunnel directly to your ISP. Either disable split tunneling entirely or ensure all browsers and privacy-sensitive applications are routed through the VPN. On Linux, also check if there are iptables or nftables rules that might bypass the tunnel.
- 6
Switch Protocol (WireGuard vs OpenVPN vs Stealth)
Go to ProtonVPN Settings → Protocol and experiment with different options. WireGuard generally provides the most reliable DNS routing on modern systems. OpenVPN (TCP or UDP) may handle DNS differently on certain networks. Stealth protocol, designed for censorship circumvention, wraps the connection in TLS and may resolve DNS routing issues caused by deep packet inspection on restrictive networks. Re-run the leak test after each protocol change.
- 7
Try a Secure Core Server for Maximum Routing Protection
Connect to a Secure Core server, which routes your traffic through a hardened server in Switzerland, Iceland, or Sweden before reaching the exit. While Secure Core does not fix device-level DNS misconfigurations, it adds an additional encrypted hop that makes DNS interception significantly more difficult. If your DNS leak only occurs on standard servers but not on Secure Core, the issue may be related to a specific exit server's configuration — report it to ProtonVPN support.
- 8
Reset Device DNS to Automatic and Retest
Open your device's network settings and remove any manually configured DNS servers. On Windows: Settings → Network → Adapter → IPv4/IPv6 Properties → set DNS to Automatic. On macOS: System Settings → Network → DNS → delete manual entries. On Linux: check /etc/resolv.conf and ensure it points to the ProtonVPN tunnel interface. Disable browser-level DNS-over-HTTPS in Chrome, Firefox, or Edge. Reconnect to ProtonVPN and re-run the test above.
ProtonVPN is in the top tier for DNS leak protection alongside NordVPN and Mullvad. ProtonVPN's key advantages are its open-source clients (allowing independent verification), Swiss jurisdiction (strong legal privacy protections), and Secure Core multi-hop routing. NordVPN offers comparable DNS leak protection with a larger server network and has been audited by PricewaterhouseCoopers. Mullvad takes a different approach with anonymous accounts but has a smaller server network. For users who prioritise transparency and verifiability, ProtonVPN's open-source commitment is a significant differentiator — you do not need to trust their marketing claims because you can verify the code yourself.
Not sure if your DNS is leaking? Find out in seconds.