What Is a DNS Leak and How Do You Test for One
Key takeaways
- A DNS leak sends your website lookups outside the VPN tunnel, usually to your internet provider.
- A two-minute test compares the resolvers used with the VPN off and on.
- Most leaks come from three causes: leak protection switched off, IPv6 traffic, or browser DNS settings.
A DNS leak happens when your device asks for website addresses through a DNS resolver that sits outside your VPN tunnel. DNS is the system that turns a domain name into the numeric address your browser needs to load the page. When those lookups escape the tunnel, the party running that resolver can see which sites you visit, even though your VPN still hides your traffic.
This article explains what a DNS leak is, including how a leak happens, how to test for one, how to read the results, and how to fix it. The test takes about two minutes, and it is worth running after any VPN install, server change, or software update.
How a DNS leak happens
A VPN is meant to route all of your traffic, including DNS lookups, through an encrypted tunnel to the VPN server. A leak means some of those lookups take a different path. The usual destination is your internet service provider, since your device often keeps using the provider DNS servers it was given when it joined the network.
The most common cause is a VPN app with DNS leak protection switched off. Some apps ship with the protection disabled, and some setups lose it after an update. A second cause is IPv6 traffic.
If the tunnel carries only IPv4 while your device also has IPv6 active, IPv6 lookups can slip past the tunnel and expose your real connection. A third cause lives in the browser. Modern browsers can run their own DNS-over-HTTPS setting, which sends lookups to a resolver the browser chose, not the one the VPN provides.
Public Wi-Fi adds another wrinkle. A hotel or airport network can push its own DNS settings onto your device, and those settings can survive after you connect the VPN. That is why a test that passes at home can fail on a new network.
The leak itself is a privacy problem, not a virus. Your pages still load, and your traffic stays encrypted. What changes is who can see the list of domains you asked for.
How to test for a DNS leak
The test compares two states: VPN off and VPN on. The comparison is the whole point. A single snapshot tells you little, because you need to know which resolvers belong to your provider and which belong to your VPN.
Start with the VPN disconnected. Open a leak-test site and note the DNS servers it lists. Two widely used test sites are DNS Leak Test and IPLeak, and BrowserLeaks offers a DNS section as well.
Write down the provider names or take a screenshot. This is your baseline.
Next, connect your VPN to a server in another country. Choosing a foreign server makes the comparison easier, since your home provider servers stand out clearly. Then refresh the same test page and run the extended test if the site offers one.
On DNS Leak Test, the Extended Test lists every resolver that answered for a unique subdomain the site assigned to your session.
Compare the two lists. A clean result shows only servers that belong to your VPN provider, usually named after the company or its locations. If any server from your baseline list appears, or if a resolver you never configured shows up, your DNS is leaking.
A VPN server in one country paired with DNS servers from your home provider is the classic red flag.
Test one more thing while you are here. DNS tests do not catch WebRTC leaks, which are a separate browser issue. On BrowserLeaks, the WebRTC section shows your public IP address.
It should match the VPN server, not your real address. A local address starting with 192.168 is normal and is not a leak.
How to read your test results
A passing test is boring, and boring is what you want. Every resolver in the list belongs to your VPN provider, and none of your home provider servers appear. The IP address shown matches the VPN server location you chose.
That means your lookups are traveling inside the tunnel.
A leaking test shows your internet provider servers, a public resolver you never set up, or a mix of both. Sometimes only one or two lookups leak while the rest stay inside the tunnel. That still counts as a leak.
A partial leak hands over a sample of your browsing history, and a sample is enough to reveal habits.
Watch for two traps when reading results. First, some VPN providers rent servers from data center companies, so a resolver name you do not recognize is not automatically a leak. Check it against your provider server list or support pages before you panic.
Second, a test run right after connecting can catch the moment before the tunnel settles. If you see a leak, wait a few seconds, refresh, and run the test again before you start changing settings.
Repeat the test when the network changes. Good moments to retest are joining a new Wi-Fi network, switching VPN servers, and updating the VPN app, the browser, or the operating system. A monthly check is a reasonable habit for anyone who relies on a VPN for privacy.
Public Wi-Fi has its own risks beyond DNS, so a leak test belongs in the same routine as checking that the network itself is safe.
How to fix a DNS leak
Start inside the VPN app. Turn on DNS leak protection if the app has the setting, and confirm the app routes DNS through its own resolvers. VPN services that run their own private DNS servers are the most reliable fix, according to CyberInsider, because the lookups never need to leave the provider network.
Update the app to the latest version first, since older builds are a common source of leaks.
Next, deal with IPv6. If your VPN handles IPv6, leave it alone. If the tunnel is IPv4 only, disable IPv6 on your device or pick a VPN that blocks or routes IPv6 traffic. Nym support notes that IPv6 traffic escaping an IPv4-only tunnel can expose a real address, and its apps block or route IPv6 per platform to prevent exactly that.
Then check the browser. Open the browser privacy or security settings and look for DNS-over-HTTPS. Turn it off, or set it to use the system resolver so the browser follows the VPN tunnel.
This one setting is behind many leaks that survive an otherwise correct VPN setup. While you are in the browser, consider what else might reveal your identity. A leaked password can do damage even without a DNS problem, so treat the browser check as part of a wider review.
If the leak persists, change the system DNS on your device to a resolver you trust, and retest. As a last resort, switch VPN servers or contact the provider support team with a screenshot of the test results. A leak that survives correct settings usually points to a broken client, a captive portal on public Wi-Fi, or a network that forces its own DNS.
In that case, avoid sensitive browsing on that network until the leak clears.
Frequently asked questions
Does a DNS leak expose my IP address?
No, not directly. A DNS leak exposes the domains you look up and the identity of the resolver answering them. Your real IP address stays hidden if the tunnel itself works.
The risk is that the domain list can be linked back to you through your provider account.
Can a DNS leak affect streaming?
Yes. Streaming platforms sometimes compare the country of your IP address with the country of the resolver answering your requests. When the two disagree, the player can fall back to your home catalog or show a proxy error.
Fixing the leak often fixes the catalog mismatch too.
Should I test without a VPN?
The baseline test with the VPN off exists only for comparison. It shows you what your unprotected connection looks like so you can spot those same servers in the VPN-on results. There is no privacy benefit to testing without a VPN, and you should not browse sensitive sites during the baseline step.
How often should I run a leak test?
Run one after installing the VPN, after changing servers, after updates, and when you join a new network. A monthly check covers the quiet changes, such as a browser update that re-enables DNS-over-HTTPS. Encryption hides the content of your traffic, but leaks can still give away metadata, so a regular test keeps the whole setup honest.
The bottom line
A DNS leak means your website lookups travel outside the VPN tunnel, usually to your internet provider. Test for it by comparing resolver lists with the VPN off and on, using the extended test on a leak-test site. Fix it by enabling leak protection, handling IPv6, and turning off browser DNS-over-HTTPS.
Run the test again after any change, and treat a clean result as the starting point, not a one-time event.
Tags: DNS leak, VPN privacy, DNS test, internet privacy
Latest in Tech
- How to Tell if a Public Wi-Fi Network Is Safe to Use
- How to Check if Your Email Password Leaked in a Breach
- End-to-End Encryption in Plain English
Subscribe to the Rive News newsletter for one practical explainer every week.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen