What Is a DNS Leak and How Do I Check and Fix It?

Updated

A DNS leak happens when your device sends domain-name lookups to a DNS server outside your VPN tunnel — usually your ISP's resolver — so the sites you visit can still be logged even while your traffic is encrypted. You can check for one in seconds with a browser-based detector such as ipleak.net: connect your VPN, load the page, and look at the "DNS detection" result. If the detected DNS servers belong to your ISP or your real location rather than your VPN provider, you have a leak. This matters most when your reason for using a VPN is hiding what you visit, not just who you are.

What a DNS leak actually is

Every time you open a site, your device first asks a DNS resolver to translate the domain name (example.com) into an IP address. That query travels separately from your normal web traffic. A VPN is supposed to route both through its encrypted tunnel. A leak means the DNS query escapes the tunnel and goes to a resolver your VPN was meant to replace.

The practical consequence: your VPN provider sees an encrypted stream, but your ISP (or another resolver) still sees a list of the domains you requested. Your IP address may be hidden while your browsing destinations are not.

How to test for a DNS leak

ipleak.net runs the check in your browser and reports several things at once.

  1. Connect your VPN first. The test is only meaningful while the VPN is active — that's the state you're trying to verify.
  2. Open the detection page and wait. The DNS section shows "Pending, please wait" until results arrive; it requires JavaScript, so a script blocker will leave it blank.
  3. Read the DNS results. The page states the rule directly: "If you are now connected to a VPN and between the detected DNS you see your ISP DNS, then your system is leaking DNS requests."
  4. Compare against your real ISP. You need to know your ISP's DNS or its name to judge the result. If the listed resolvers match your VPN provider or a location you don't recognize as your own, the tunnel is holding.
  5. Check the other panels too. The same page reports your IP addresses, WebRTC detection, and torrent address detection, so you can see whether the leak is DNS-specific or part of a broader exposure.

A clean result shows only your VPN's DNS servers. A leak shows your ISP's servers, your home country, or both.

Common causes

  • VPN not set to route DNS. Some clients tunnel traffic but leave DNS to the operating system, which keeps using the ISP resolver.
  • OS-level DNS overriding the VPN. Manually configured DNS on your adapter, or a router handing out its own resolver, can bypass the tunnel.
  • IPv6 left uncovered. Many VPNs handle IPv4 only; if IPv6 is enabled, queries can slip out over it. ipleak.net lists IPv6 leak detection as a separate check for this reason.
  • WebRTC exposure. WebRTC uses STUN to discover your public IP address. As the site notes, if you're on a VPN and still see your ISP IP, "your system is leaking WebRTC requests." This is an IP leak rather than a DNS leak, but it defeats the same goal.
  • Split tunneling or a dropped tunnel. If only some apps use the VPN, or the tunnel drops without a kill switch, DNS can revert to the ISP.

How to fix it

  • Enable DNS handling in your VPN client. Turn on any setting that forces DNS through the tunnel, and enable a kill switch so queries can't fall back when the connection drops.
  • Set the VPN's DNS explicitly. Point your device at the resolver your VPN provides rather than "automatic."
  • Disable IPv6 if your VPN doesn't support it, or confirm it does before leaving it on.
  • Turn off WebRTC if you don't need it. The page gives the Firefox method: type about:config in the address bar, find media.peerconnection.enabled, and double-click to set it to false. Chrome requires an extension for the same effect.
  • Re-test after every change. Fixes that look correct in settings still fail in practice; the detection page is the confirmation step.

When a DNS leak is a real risk — and when it isn't

It's a genuine problem if your threat model includes your ISP or network operator seeing which sites you visit — for example, circumventing local censorship or keeping browsing private from an employer's network. It matters less if you only use a VPN to hide your IP from the sites themselves, since those sites already know which domain you asked for.

Two caveats worth keeping in mind. First, a leak exposes destinations, not the content of encrypted traffic — HTTPS still protects what you send and receive. Second, seeing an unfamiliar DNS server isn't automatically a leak; VPN providers often route DNS through third-party resolvers, so identify the server before assuming the worst. The reliable test is the one the page states: on a VPN, your ISP's DNS should not appear.