What Is a DNS Leak and Why Does It Affect Surfshark Users?
DNS — the Domain Name System — is the mechanism your device uses to translate human-readable website addresses like google.com into numerical IP addresses that servers understand. Every time you visit a website, your device sends a DNS query to a DNS resolver, and by default that resolver belongs to your internet service provider. This means your ISP has a real-time log of every website you visit, timestamped and tied to your account, regardless of whether the website itself uses HTTPS encryption.
When you connect to Surfshark, all your DNS queries should be routed through Surfshark's own private DNS servers, which are built into every VPN server in their network. A DNS leak occurs when some or all of those queries escape the encrypted tunnel and are sent directly to your ISP's DNS servers instead. From your perspective, Surfshark appears connected and your IP address may be masked — but your ISP can still see a complete list of every website you visit in real time.
Surfshark users experience DNS leaks for several reasons specific to how the service is used. Because Surfshark allows unlimited simultaneous device connections, many users run it on a wide range of devices — phones, tablets, laptops, smart TVs, routers — each with different DNS configurations. A DNS leak on one device does not mean all devices are affected, but it does mean each device needs to be tested individually. Split tunneling settings, which allow certain apps to bypass the VPN, are another common cause — excluded apps also send their DNS queries outside the tunnel. Protocol differences between WireGuard and OpenVPN can also affect DNS routing behaviour on specific platforms.
The users most at risk of Surfshark DNS leaks are those running the VPN on Windows with IPv6 enabled, since Surfshark's tunnel may only cover IPv4 traffic on some configurations, leaving IPv6 DNS queries unprotected. Users who have manually set DNS servers on their device — such as Google DNS (8.8.8.8) or Cloudflare (1.1.1.1) — are also at elevated risk because those settings can override Surfshark's DNS routing. Additionally, users who connect to multiple devices with different operating systems may find that Surfshark's DNS protection works perfectly on one platform but leaks on another due to platform-specific DNS handling differences.
Regular testing is critical because DNS leaks are entirely silent. Surfshark will show a green "Connected" status, your IP address will appear masked, and your internet speed may even improve — all while your DNS queries are being sent to your ISP in plain text. A leak can appear after a Surfshark update, a change in your network environment, or simply after switching from Wi-Fi to mobile data. The test above takes 10 seconds and confirms whether Surfshark is handling your DNS traffic correctly right now.
Does Surfshark Have DNS Leak Protection?
Surfshark operates its own private DNS servers on every VPN server in their network across 100+ countries. When you connect to any Surfshark server, all DNS queries are resolved locally on that server within the encrypted tunnel — your ISP's DNS servers are never contacted. This architecture means that DNS resolution happens entirely within Surfshark's infrastructure, and no third-party DNS provider (Google, Cloudflare, or otherwise) is involved in resolving your queries.
Surfshark's CleanWeb feature adds an additional DNS-level protection layer by blocking connections to known malicious domains, phishing sites, ad trackers, and malware distribution networks at the DNS resolution stage. When CleanWeb is enabled, DNS queries for flagged domains are intercepted before your browser makes the connection. This does not replace DNS leak protection — it operates within the already-encrypted DNS channel — but it does provide a secondary benefit of preventing your device from connecting to dangerous domains even if you click on a malicious link.
Surfshark's Kill Switch feature blocks all internet traffic — including DNS queries — if the VPN connection drops unexpectedly. This prevents the brief window of vulnerability during which your device would fall back to your ISP's DNS and expose your browsing history. The Kill Switch is available on all major platforms (Windows, macOS, iOS, Android, and Linux) but is not enabled by default on every platform. You should verify it is active in Surfshark's Settings → Connectivity section on each device.
Despite these protections, DNS leaks can still occur with Surfshark in specific scenarios. The most common is on Windows devices with IPv6 enabled — Surfshark's tunnel may only route IPv4 traffic, leaving IPv6 DNS queries to travel directly to your ISP. Split tunneling is another frequent cause: if you have configured certain apps to bypass the VPN, their DNS queries are also excluded from the tunnel. Browser-level DNS-over-HTTPS settings in Chrome, Firefox, or Edge can bypass the VPN tunnel entirely, sending DNS queries to Cloudflare or Google regardless of Surfshark's protection. And if the Kill Switch is disabled during a brief disconnection, all DNS traffic falls back to your ISP until Surfshark reconnects.
How to Fix a Surfshark DNS Leak – Step by Step
- 1
Confirm the Leak Using the Test Above
Run the DNS leak test at the top of this page while connected to Surfshark. If the DNS server shown matches your ISP rather than Surfshark, you have a confirmed leak. Run the test on multiple servers and from multiple devices to determine whether the leak is consistent or isolated to a specific device or configuration.
- 2
Update Surfshark to the Latest Version
Older Surfshark client versions may have DNS handling bugs that have been patched in newer releases. Open Surfshark, check for updates in the app, or download the latest version from surfshark.com. Surfshark regularly releases updates that improve DNS leak protection, particularly on Windows and Android where DNS routing is more complex.
- 3
Enable Surfshark Kill Switch in Settings
Open Surfshark, go to Settings → Connectivity, and enable the Kill Switch. This blocks all internet traffic — including DNS queries — if the VPN connection drops, preventing your device from falling back to your ISP's DNS during reconnection. The Kill Switch is not enabled by default on all platforms, so check each device individually.
- 4
Disable Split Tunneling or Audit Split Tunnel Rules
If you're using Surfshark's Bypasser (split tunneling) feature, review which apps and websites are excluded from the VPN tunnel. Excluded apps send their DNS queries directly to your ISP. Either disable Bypasser entirely or ensure your web browsers and any privacy-sensitive apps are routed through the VPN tunnel.
- 5
Switch Protocol (WireGuard vs IKEv2 vs OpenVPN)
Go to Surfshark Settings → Protocol and try switching between WireGuard, IKEv2, and OpenVPN. WireGuard generally handles DNS routing most reliably on modern operating systems, while OpenVPN may perform better on networks that block WireGuard traffic. Re-run the DNS leak test after each protocol change to compare results.
- 6
Try a Different Surfshark Server Location
The specific server you're connected to may have a temporary DNS configuration issue. Disconnect, select a server in a different country, reconnect, and re-run the test. If the leak only occurs on certain servers, report it to Surfshark support so they can investigate the server-side configuration.
- 7
Check Device DNS Settings and Reset to Automatic
Open your device's network settings and verify you haven't manually configured DNS servers. On Windows: Settings → Network → Adapter → IPv4/IPv6 Properties → set DNS to Automatic. On macOS: System Settings → Network → DNS → remove all manual entries. Custom DNS servers (like 8.8.8.8 or 1.1.1.1) can override Surfshark's private DNS routing and cause leaks.
- 8
Reinstall Surfshark and Retest
If the leak persists after all previous steps, uninstall Surfshark completely, restart your device, download a fresh copy from surfshark.com, install it, and reconnect. A clean installation removes any corrupted configuration files, outdated network adapter settings, or cached DNS entries that may be causing the persistent leak. Re-run the test above to confirm the fix.
Surfshark has passed independent security audits by Cure53 and Deloitte, and operates under a verified no-logs policy. For most privacy use cases — including protecting browsing activity from ISPs, securing public Wi-Fi connections, and preventing basic tracking — Surfshark provides adequate protection when properly configured. However, for high-stakes privacy scenarios such as whistleblowing, journalism in restrictive countries, or protecting sensitive business communications, you should verify DNS leak protection on every device, enable the Kill Switch, disable split tunneling entirely, and consider a VPN with a longer track record of independent audits.
Not sure if your DNS is leaking? Find out in seconds.