What Is a DNS Leak?

Every time you type a website address into your browser, your device needs to convert that human-readable name (like google.com) into a numerical IP address a router can use. That translation is called a DNS lookup, and it's handled by a DNS server — almost always one operated by your Internet Service Provider (ISP) unless you've configured otherwise.

Think of DNS as the phone book of the internet. Your ISP's DNS server receives a query for every single domain you visit. By logging these queries, your ISP builds a detailed record of your browsing activity: which news sites you read, which social platforms you use, what time you go to bed.

A DNS leak occurs when your DNS queries are sent to your ISP's servers instead of your VPN's DNS servers — even though your VPN is connected and your IP address is hidden. Your real browsing destinations are exposed to your ISP even though you believe you're protected.

DNS leaks are more common than most people realise. Several technical factors can cause them:

1. Operating system DNS bypass

Windows 10 and 11 have a feature called Smart Multi-Homed Name Resolution that sends DNS queries to multiple resolvers simultaneously — including your ISP's — to speed up lookups. VPNs that don't explicitly block this behaviour will leak DNS regardless of how securely the tunnel itself is configured.

2. IPv6 DNS requests

Most VPNs tunnel IPv4 traffic but leave IPv6 handling incomplete. If your ISP has assigned you an IPv6 address and your VPN doesn't route IPv6 through the tunnel, DNS lookups over IPv6 go directly to your ISP's resolver. This is sometimes called an IPv6 DNS leak.

3. Misconfigured split tunnelling

Split tunnelling lets you route some apps through the VPN and others through your regular connection. If DNS routing isn't configured correctly alongside split tunnelling, the apps using your regular connection will leak DNS to your ISP.

4. VPN connection drops

When a VPN connection drops momentarily, your device falls back to your default DNS settings — your ISP's servers — until the VPN reconnects. A VPN kill switch prevents new traffic from going out during this gap, but some implementations don't include DNS in that protection.

5. Manually configured third-party DNS

If you've set a public DNS resolver (like 8.8.8.8 or 1.1.1.1) in your operating system's network settings, some VPN clients will respect that manual override and route DNS outside the tunnel. Those queries then go directly to the configured resolver without VPN encryption.

Testing for a DNS leak is straightforward and takes under 60 seconds:

1. Connect your VPN and wait for it to confirm a successful connection.
2. Run the DNS leak test on our homepage — it checks which DNS servers are handling your queries and whether they match your VPN provider or your ISP.
3. Check the results. You should see DNS servers that belong to your VPN provider, not your home ISP. If you see your ISP's DNS servers listed, you have a leak.
4. Run a second test with an extended check to catch intermittent leaks that only appear on some queries.

Use a VPN with built-in DNS leak protection

The most reliable fix is using a VPN that routes all DNS queries through its own encrypted DNS servers and explicitly blocks system-level DNS bypass. NordVPN, Mullvad, and ProtonVPN all offer DNS leak protection by default — no manual configuration needed.

Disable Smart Multi-Homed Name Resolution (Windows)

On Windows, you can disable the DNS bypass feature via Group Policy:

1. Press Win + R, type gpedit.msc, press Enter
2. Navigate to Computer Configuration → Administrative Templates → Network → DNS Client
3. Find Turn off smart multi-homed name resolution and set it to Enabled

Force your DNS to a privacy-respecting resolver

If you use a VPN that doesn't manage DNS itself, configure a trusted public resolver in your operating system's network settings. Cloudflare's 1.1.1.1 and Quad9's 9.9.9.9 both offer no-logging DNS and support DNS over HTTPS (DoH) and DNS over TLS (DoT) for encrypted queries.

Enable your VPN's kill switch

A kill switch cuts your internet connection if the VPN drops, preventing your device from falling back to unencrypted DNS. Most major VPN clients offer this in their settings — enable it and keep it on.

Disable IPv6 if your VPN doesn't tunnel it

If your VPN client doesn't explicitly handle IPv6, the safest option is to disable IPv6 on your network adapter until your VPN adds support. On Windows: Control Panel → Network Adapter Properties → uncheck Internet Protocol Version 6.