DNS Leak Prevention
What causes DNS leaks, how to test for them, and how to fix them to maintain VPN privacy.
What Is a DNS Leak?
A DNS leak occurs when your DNS queries bypass your VPN tunnel and are sent to your ISP's DNS servers instead of the VPN's DNS servers. This means your ISP can see which websites you visit, even though the rest of your traffic is encrypted.
How DNS Leaks Happen
When you type example.com in your browser, your device needs to resolve that domain name to an IP address. This DNS query should go through the VPN tunnel, but several situations can cause it to leak:
- OS-level DNS handling — Windows may use its built-in Smart Multi-Homed Name Resolution, querying all available DNS servers including your ISP's
- IPv6 leaks — If your VPN only tunnels IPv4 traffic, IPv6 DNS queries bypass the tunnel
- VPN disconnection — Brief connection drops can cause DNS queries to use default (ISP) servers
- Manual DNS settings — If you've configured custom DNS servers at the OS level, they may override the VPN's DNS
Testing for DNS Leaks
Use a DNS leak test tool to check if your VPN is leaking. The test works by:
- Making DNS queries to unique test domains
- Recording which DNS servers resolved those queries
- Showing you whether the resolving servers belong to your VPN or your ISP
If you see your ISP's DNS servers in the results while connected to a VPN, you have a leak.
Fixing DNS Leaks
Use Your VPN's Built-in DNS
Most quality VPN providers run their own DNS servers and configure your device to use them when connected. Enable this in your VPN app settings.
Disable IPv6 (If Not Supported)
If your VPN doesn't support IPv6, disable it at the OS level to prevent IPv6 DNS leaks:
# Linux — disable IPv6 temporarily
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
Enable the Kill Switch
A kill switch blocks all internet traffic if the VPN connection drops, preventing DNS queries from leaking during reconnection.
Set DNS at the VPN Level
Configure DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) through the VPN tunnel for an extra layer of encryption on DNS queries.
Prevention Checklist
- [ ] Enable your VPN's built-in DNS protection
- [ ] Activate the kill switch
- [ ] Test for leaks after connecting
- [ ] Disable IPv6 if your VPN doesn't support it
- [ ] Avoid setting custom DNS servers at the OS level while using a VPN