Understanding DNS Leaks: Why Your VPN Might Be Lying to You

January 15, 2025 · 6 min read

A DNS leak is one of the most common and least understood VPN failures: the VPN is connected, your IP is hidden, yet every domain you visit still reaches your ISP’s DNS servers: visible, logged, and entirely outside the tunnel. Here’s how leaks happen, how to test for them, and how to make sure your VPN handles DNS correctly.

What is DNS and why does it matter?

DNS is the internet’s phone book: before your browser connects anywhere, your device asks a DNS resolver to translate the domain name (google.com) into an IP address. That query travels across the network before any connection to the site is made.

If the query goes to your ISP’s resolver instead of through the VPN tunnel, your ISP sees every domain you look up, even when the connection that follows is fully protected. The query reveals the destination before the connection exists.

How DNS leaks happen

Most leaks come from four mechanisms: silent fallback, IPv6, browser behavior, and network-specific overrides.

• DNS fallback. If the VPN’s resolver is temporarily unreachable, Windows and macOS fall back to system DNS (usually your ISP’s) silently, with no warning.
• IPv6. Tunnels that only handle IPv4 let IPv6 DNS queries bypass the VPN entirely on connections where IPv6 is active.
• Browser features. Some browser features skip the VPN’s DNS settings and use system DNS directly.
• Corporate configurations. Company networks sometimes pin certain domains to resolve through the local network, leaking those queries outside the tunnel.

How to prevent DNS leaks

The fix is making sure every DNS query travels inside the tunnel to the VPN’s own resolver, and that nothing falls back outside it when that resolver hiccups. In practice:

• Use a VPN client that configures DNS at the OS level, not just for the VPN interface.
• Prefer fail-closed behavior: if the tunnel’s resolver is unreachable, the query should fail rather than fall back to your ISP.
• If your VPN doesn’t tunnel IPv6, disable IPv6 on your network adapter.
• Re-test after OS updates and on new networks; DNS configuration is fragile, and a setup that was leak-free last month may not be today.

How to test for DNS leaks

Run an extended DNS leak test while connected; only your VPN provider’s resolvers should appear in the results.

1. Connect to your VPN.
2. Visit a DNS leak test website and run the extended test.
3. Examine the servers listed: you should see only the VPN’s DNS resolvers.
4. If your ISP’s servers appear (Comcast, AT&T, Sky, Deutsche Telekom, and so on), you have a leak. Apply the fixes above, retest, and contact your VPN’s support if it persists.

Frequently asked questions

Can I use custom DNS with a VPN?

Often, yes: many VPN apps let you specify custom resolvers such as 1.1.1.1 or 8.8.8.8. What matters is where the query travels: set inside the VPN app, it goes through the tunnel; set at the OS level, it may bypass the tunnel and leak.

Is DNS encryption the same as DNS leak protection?

No. DNS encryption (DNS-over-HTTPS or DNS-over-TLS) hides the content of queries between your device and the resolver. Leak protection is about routing: ensuring queries travel through the VPN tunnel to the intended resolver at all. You can have either one without the other.