What is a DNS leak and how do you fix it?

DNS in 30 seconds

Before your device can open a website, it has to turn a name like example.com into an IP address. It does that by asking a DNS resolver, usually run by your internet provider. The resolver sees every site name you look up, when you look it up, and your IP address.

What is a DNS leak?

When you use a VPN, those lookups should go through the encrypted tunnel to the VPN's own resolver. A DNS leak happens when they go around the tunnel instead, straight to your provider or another outside resolver.

Your traffic itself is still encrypted, but the resolver can see a list of every site you visit, and anyone watching your connection can see it too. In some countries, providers use DNS to block websites, so a leak can also make blocked sites fail even with a VPN on.

A DNS leak doesn't change the IP address websites see. It exposes which sites you visit to your provider. That's why an IP check alone can't detect it.

How to test for a DNS leak

1. Connect to your VPN.
2. Open the DNS leak test. It makes your browser look up several random names that only our test server can answer, and records which resolvers ask for them.
3. Look at the resolvers it lists.

No leak: every resolver belongs to your VPN provider, or is in the same country your VPN exits from.

Leak: you see resolvers from your own internet provider, or in your own country while your VPN server is somewhere else.

Large public resolvers such as Google (8.8.8.8) and Cloudflare (1.1.1.1) run servers worldwide. For those, the test also shows the client subnet the resolver passed on, which can reveal your real network even when the resolver itself looks neutral.

What causes DNS leaks?

• The VPN doesn't set its own DNS. Some VPN apps, manual WireGuard or OpenVPN setups, and many proxy tools leave your system resolver unchanged.
• Windows asks every network at once. Windows sends DNS queries to all network adapters and takes the fastest answer, so the query can leave through your normal connection.
• IPv6. If the VPN only handles IPv4, lookups over IPv6 go to your provider's IPv6 resolver.
• Browser DNS-over-HTTPS. Chrome, Edge and Firefox can send lookups to their own encrypted resolver. That's not a leak to your provider, but it bypasses the VPN's resolver and can carry your real location.
• Proxy tools in "system proxy" mode. Apps such as Clash, V2Ray or Shadowsocks clients often only proxy browser traffic, while the system still resolves names locally.
• Your router or provider hijacks DNS. Some providers intercept all traffic on port 53 and answer it themselves.

How to fix a DNS leak

Start with the first fix and test again after each step.

1. Turn on your VPN's DNS leak protection. Most good VPN apps have a setting called DNS leak protection, "use VPN DNS only" or similar. Also turn on the kill switch.
2. Turn on IPv6 leak protection or block IPv6 in the VPN app. See IPv4 vs IPv6 for why this matters.
3. Set DNS in your VPN config. For WireGuard, add a DNS = line in the [Interface] section. For OpenVPN, use block-outside-dns on Windows.
4. For proxy tools, enable TUN mode (Clash, sing-box and others call it TUN, enhanced mode or VPN mode) and turn on their DNS handling, so all lookups go through the proxy.
5. Check your browser's secure DNS setting. In Chrome or Edge, it's under Settings > Privacy and security > Security > Use secure DNS. Either turn it off so the VPN's resolver is used, or set it to a resolver you trust.
6. Change your system DNS to a public resolver as a fallback. This doesn't fix a leak to that resolver, but it stops your provider seeing your lookups.

Then run the DNS leak test again. For a full check of your VPN, including WebRTC and IPv6, see how to check if your VPN is working.

FAQ

Is a DNS leak dangerous?

It exposes the sites you visit, not your passwords or page content, which stay protected by HTTPS. Still, if you use a VPN for privacy, a leak defeats much of the point.

Can a DNS leak reveal my real IP?

Indirectly. Your provider's resolver sees your real IP, and resolvers that pass on your client subnet tell the website's DNS server roughly where you are. Websites themselves don't see your IP through DNS.

Does using 1.1.1.1 or 8.8.8.8 prevent DNS leaks?

No. It changes who sees your lookups, from your provider to Cloudflare or Google, but those lookups can still go outside your VPN. Only routing DNS through the VPN stops the leak.

Why does the test show servers in another country?

Large resolvers send your query from the data center nearest to you or to your VPN server, which may be in a neighboring country. Check the network name: if it's your VPN provider or a big public resolver near the VPN server, that's fine.