Not sure if your DNS is leaking? Find out in seconds.
Why Public WiFi Is High Risk for DNS Leaks
Public WiFi networks at coffee shops, airports, hotels, and libraries are convenient, but they're also one of the biggest privacy risks online. When you connect to a public network, the router assigns DNS servers automatically via DHCP. These DNS servers are controlled by whoever operates the network — and they can log every domain you visit. In many cases, the DNS servers belong to the ISP providing the network's internet connection, meaning your browsing activity is being recorded even on a "free" WiFi network.
Even if you connect to a VPN on public WiFi, there's a brief window during the connection handshake where your DNS queries may be sent unencrypted. Some operating systems also send DNS queries outside the VPN tunnel when resolving captive portal pages (the login screen you see on hotel or airport WiFi). This can expose your real DNS server before your VPN is fully active.
How Attackers Intercept DNS on Public Networks
On an unsecured public WiFi network, an attacker can perform several types of DNS-based attacks. The most common is DNS spoofing (also called DNS poisoning), where the attacker intercepts your DNS queries and returns fake IP addresses, redirecting you to phishing sites that look identical to legitimate ones. For example, you might think you're logging into your bank's website, but you're actually entering your credentials on a fake page controlled by the attacker.
Another technique is setting up a rogue DHCP server that pushes malicious DNS settings to every device that connects to the network. This allows the attacker to control DNS resolution for all users on the network without needing to intercept individual queries. For a broader understanding, see what is a DNS leak.
Practical Tips to Stay Protected
- Always use a VPN — connect to your VPN before doing anything on the network. Choose one with a kill switch and built-in DNS leak protection.
- Set manual DNS servers — configure your device to use encrypted DNS providers like 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9) instead of accepting the network's defaults.
- Enable DNS over HTTPS — turn on DoH in your browser to encrypt DNS queries. See our guides for Chrome and Firefox.
- Disable auto-connect — prevent your device from automatically joining open WiFi networks.
- Forget networks after use — remove saved public WiFi networks from your device to avoid reconnecting automatically in the future.
- Test regularly — run a free DNS leak test every time you connect to a new network.
Mac users are especially vulnerable on public WiFi due to how macOS handles DHCP DNS assignments. See our Mac DNS leak test page for platform-specific fixes.
Not sure if your DNS is leaking? Find out in seconds.