To check for DNS leaks, connect to your VPN, open a DNS leak test tool in your browser, run it and see which resolvers it reports. If they belong to the VPN or a resolver you chose, you are fine. If they belong to your internet provider, your lookups are escaping the tunnel and need fixing.
What a DNS leak is
Every time you visit a site, your device asks a DNS resolver to turn the name into an address, as we describe in DNS explained for beginners. When a VPN works properly, those questions travel inside the encrypted tunnel to the VPN’s own resolver. A DNS leak happens when some of them are sent outside the tunnel to your regular resolver, usually your internet provider’s.
The page content may still be encrypted, but the list of domains you look up is exposed to the network and the provider. That undermines one of the reasons for using a VPN in the first place.
Why leaks happen
- Operating system behaviour. Some systems send DNS queries to several resolvers at once and use whichever answers first, including the local one.
- Misconfigured VPN settings. A manual or router-based setup that does not override the DNS settings.
- IPv6 traffic. If the VPN only handles IPv4, IPv6 requests may bypass it. Our explainer on IP addresses covers the two versions.
- Dropped connections. When the tunnel falls over briefly, traffic may go out in the open unless a kill switch blocks it.
- Browser features. Browsers with their own encrypted DNS settings can send lookups to a different resolver than the VPN’s.
- Split tunneling. Apps you exclude from the VPN will use your normal resolver by design.
How to check for DNS leaks, step by step
Step 1: Get a baseline without the VPN
Disconnect from the VPN and run a DNS leak test from a reputable testing website. Note which resolvers or provider names it lists. These are the ones you do not want to see later.
Step 2: Connect to the VPN
Turn the VPN on, wait for the connection to settle and confirm your public IP address now differs from your normal one.
Step 3: Run the test again
Use the standard or extended test. The tool makes your device look up many unique names and then reports which resolvers answered them.
Step 4: Read the results
| What you see | What it means |
|---|---|
| Resolvers belonging to the VPN, or a resolver you picked deliberately | No leak |
| Your internet provider’s resolver, same as the baseline | Leak |
| A mix of both | Partial leak, needs fixing |
| A large public resolver you did not choose | Check settings; it may be your browser’s encrypted DNS |
Be a little careful about what the tool tells you. It identifies a resolver by its address, and the owner is a best guess. Also be aware that testing sites see your IP address when you use them, so choose one you are comfortable with and use it only for testing.
Fixing a DNS leak
- Update the VPN app. Leak protection is often improved through updates, and it may be a setting you can switch on.
- Turn on the kill switch and any DNS or IPv6 leak protection in the app. Our guide to the VPN kill switch explains how it works.
- Check your browser. If it has a secure DNS setting that points to a particular provider, set it to follow the system or the VPN, or turn it off while testing.
- Review split tunneling. Make sure the app or browser you are testing is not excluded.
- Disable IPv6 as a test. If the leak vanishes, the VPN does not handle IPv6 well. Look for a setting in the app, or ask the provider for guidance.
- Set DNS manually as a last resort. Point your device at the VPN’s resolver or a trusted one, following your provider’s documentation.
- Restart and retest. Run the same test again and compare with the baseline.
If none of this helps, contact the VPN provider’s support with the results. A leak that you cannot fix is a good reason to try a different app or service.
Testing without a VPN
Treat the test as a health check rather than a one-off chore, because settings drift over time as apps and systems update. The same test is useful even if you do not use a VPN, because it shows which resolver you actually rely on. If you changed DNS on your router or enabled encrypted DNS, you can confirm that the change took effect.
Where to start
Pick a quiet moment, run a baseline test, connect your VPN and test again. Repeat after major system or app updates, when you change networks and after altering any DNS or browser settings. If the results are clean, you can relax. If not, work through the fixes above one at a time, retesting after each. For more practical networking guides, browse our Wi-Fi and networking category.
Frequently asked questions
How often should I check for DNS leaks?
Test when you first set up a VPN, after major updates and whenever you change DNS or browser settings. There is no need to test daily.
Does a DNS leak mean my passwords are exposed?
No. A leak exposes which domain names you look up, not the content of encrypted connections. It still weakens your privacy.
Can a browser cause a DNS leak?
Yes. If the browser's own secure DNS setting uses a different resolver, its lookups may skip the VPN's resolver.
Are online DNS leak tests reliable?
They are a useful guide but not perfect. Their identification of resolver owners is approximate, so compare results with your baseline.
