What Is a VPN DNS Leak?
When you connect to a VPN, all your internet traffic — including DNS queries — should travel through the VPN's encrypted tunnel. A DNS leak happens when your DNS requests bypass the VPN tunnel and go directly to your ISP's DNS servers instead. This means your ISP can see every website you visit, even though the rest of your traffic is encrypted.
DNS leaks are particularly dangerous because they're invisible. Your VPN app will still show you as "connected" and "protected." You won't notice anything different about your browsing experience. The only way to detect a DNS leak is to run a dedicated test.
Think of it this way: your VPN encrypts the content of your mail, but a DNS leak means the postal service can still read every address on every envelope. They know exactly where your letters are going — they just can't read what's inside.
How to Test Your VPN for DNS Leaks: Step-by-Step
Testing your VPN for DNS leaks takes less than a minute. Follow these steps carefully to get accurate results:
Step 1: Connect to Your VPN
Open your VPN application and connect to any server. Wait until the VPN confirms the connection is active. If your VPN has a "DNS leak protection" or "kill switch" option, make sure it's enabled — you want to test your VPN in its best configuration first.
Step 2: Run a DNS Leak Test
Visit our DNS Leak Checker and click "Check for DNS Leak." The tool sends multiple DNS queries and identifies which DNS servers are handling your requests. This process takes just a few seconds.
Step 3: Analyze Your Results
The test results will show you a list of DNS servers that responded to your queries. Here's how to interpret them:
- No leak detected: The DNS servers shown belong to your VPN provider, not your ISP. Your VPN is working correctly.
- Leak detected: You see DNS servers belonging to your ISP (like Comcast, AT&T, BT, Vodafone, etc.). Your browsing history is being exposed.
- Mixed results: Some queries go through your VPN, some through your ISP. This is still a leak and needs to be fixed.
Step 4: Test Multiple Scenarios
For thorough testing, repeat the test after: switching VPN servers, reconnecting after a disconnect, switching between Wi-Fi and mobile data, and after restarting your device. DNS leaks can appear intermittently, so testing once isn't always enough.
Understanding the Difference Between IP Leaks and DNS Leaks
Many people confuse IP leaks with DNS leaks, but they're fundamentally different privacy threats that require different solutions. Understanding the distinction helps you protect yourself more effectively.
IP leaks expose your real IP address. When your actual IP address is visible, anyone can determine your physical location, your ISP, and potentially your identity. IP leaks can happen through WebRTC (a browser technology), through improperly configured VPN protocols, or when your VPN connection drops without a kill switch. You can check for IP leaks using our IP Checker tool.
DNS leaks expose your browsing activity. Even if your IP address is hidden, DNS leaks let your ISP see every website you visit. Your ISP logs these queries, and in many countries, they're required to store this data and can share it with government agencies or sell it to advertisers.
In practice, you need to test for both. A VPN that hides your IP but leaks your DNS is only giving you half the privacy you expect. Similarly, a VPN that protects DNS but leaks your IP through WebRTC is equally compromised. Use our complete suite of tools: the DNS Leak Checker, the IP Checker, and the WebRTC Leak Test.
Common Reasons Your VPN Still Leaks DNS
If your VPN DNS leak test shows a problem, one of these issues is likely the cause:
1. Your VPN Doesn't Have DNS Leak Protection
Many budget and free VPNs simply don't include DNS leak protection. They create an encrypted tunnel for your regular traffic but don't force DNS queries through it. This is one of the most common causes of DNS leaks, and the only fix is switching to a VPN that specifically prevents them.
2. Your Operating System Overrides VPN DNS
Windows is particularly prone to this. Features like Smart Multi-Homed Name Resolution send DNS queries through all available network interfaces simultaneously — including ones outside the VPN tunnel. macOS and Linux can also override VPN DNS settings in certain configurations. See our platform-specific guides for Windows and Mac.
3. IPv6 Traffic Isn't Being Tunneled
Many VPNs only tunnel IPv4 traffic. If your ISP supports IPv6, your device might send DNS queries over IPv6 directly, completely bypassing the VPN. This is an increasingly common leak vector as IPv6 adoption grows worldwide.
4. DNS Cache from Before VPN Connection
If you browsed websites before connecting to your VPN, cached DNS entries can persist and be reused outside the VPN tunnel. Flushing your DNS cache before connecting helps prevent this.
5. VPN Disconnects Without a Kill Switch
VPN connections can drop momentarily due to network instability. Without a kill switch, your device immediately reverts to your ISP's DNS servers, exposing your queries until the VPN reconnects. You might never notice these brief disconnections.
6. Browser-Level DNS Settings
Some browsers, particularly Chrome and Firefox, have their own DNS settings that can override system-level and VPN DNS configurations. Chrome's "Secure DNS" feature and Firefox's DNS over HTTPS can send queries to Google or Cloudflare instead of through your VPN. Check our guides for Chrome and Firefox.
What to Do If Your VPN Is Leaking DNS
If your test revealed a DNS leak, don't panic. Here's a prioritized action plan:
- Check your VPN's settings for a "DNS leak protection" toggle and enable it
- Enable the kill switch in your VPN application
- Flush your DNS cache (see our complete fix guide)
- Disable IPv6 on your network adapter if your VPN doesn't support it
- Change your system DNS to a privacy-focused provider (1.1.1.1 or 9.9.9.9) as a fallback
- Re-test with our DNS Leak Checker after each change
If the leak persists after trying these fixes, the issue is likely with your VPN itself. Not all VPNs are built to the same standard. Our analysis of VPNs with the best DNS leak protection can help you find a more reliable alternative.
How to Verify Your VPN Is Fully Working
A DNS leak test is essential, but it's only one piece of the puzzle. For complete verification, you should also check whether your VPN is working across all vectors. Our guide on how to check if your VPN is working covers the three critical tests you need to run: IP address verification, DNS leak testing, and WebRTC leak testing. Only when all three pass can you be confident your VPN is truly protecting you.
Recommended Solution
If your DNS leak test reveals that your current VPN isn't protecting you properly, NordVPN consistently passes our leak tests. It routes all DNS queries through its own servers, handles IPv6 traffic correctly, and includes an automatic kill switch on every platform. It's the simplest way to ensure your DNS queries stay private.
Changing your DNS provider to Cloudflare (1.1.1.1) or Google (8.8.8.8) improves privacy but doesn't fully prevent DNS leaks. Without a VPN, your ISP can still see your DNS queries in transit. A VPN with DNS leak protection is the most complete solution.