What Is a DNS Leak? How to Test for One and Fix It

You switch on your VPN, the app says you’re connected, and websites now see the VPN’s location instead of yours. But if your device is still sending its DNS lookups the usual way, your internet provider can see the names of the sites you visit anyway.

That’s a DNS leak: DNS lookups that travel outside your VPN’s encrypted tunnel, usually to your internet provider’s servers, revealing where you go online even though the rest of your traffic is protected.

This guide covers what causes a DNS leak, how to run a DNS leak test step by step, how to fix one, and two related leaks to check.

What is DNS?

DNS, short for Domain Name System, is the internet’s phone book. Devices find each other by numeric IP addresses, but you type names. So every time you open a website, or an app contacts its server, your device asks a DNS server, called a resolver, to look up the matching number. By default, it’s usually your internet provider’s (ISP’s) resolver, assigned automatically when you connect. Traditional DNS lookups aren’t encrypted, so whoever handles them can read every name you look up.

What is a DNS leak, and why does it matter?

With a VPN working properly, your DNS lookups travel inside its encrypted tunnel to a resolver your VPN provider runs or chooses, and your ISP sees only scrambled traffic heading to the VPN server.

A DNS leak happens when some or all of those lookups escape the tunnel and go to a resolver outside it, most often your ISP’s, just as if the VPN were off. The app still says you’re connected, your IP address still shows the VPN location, and nothing looks wrong.

That matters because:

• It reveals your browsing. Leaked lookups show which sites and services you use, and when, which is much of what your internet provider can see without a VPN.
• It ties activity to you. The leaking resolver sees requests arriving from your real connection, not from the VPN.
• It exposes you on untrusted networks. Unencrypted lookups on public Wi-Fi can be read, or tampered with on a malicious network, as our guide to staying safe on public Wi-Fi explains.

A DNS leak doesn’t expose the contents of HTTPS pages or your passwords. It’s a privacy leak rather than a full breach, but it undercuts one of the main reasons to use a VPN.

What causes a VPN DNS leak?

Most leaks happen because the operating system, network or browser makes its own decisions about DNS.

Windows queries every network adapter

Since Windows 8, a feature called Smart Multi-Homed Name Resolution can send DNS queries over all your network connections at once, such as Wi-Fi, Ethernet and the VPN, and use whichever answer arrives first. The copy sent over your regular connection skips the tunnel entirely. Well-built VPN apps work around this, but it’s a classic cause of leaks on Windows.

IPv6 traffic the VPN doesn’t handle

Many networks now support IPv6, the newer internet address format, alongside the older IPv4. If your VPN tunnels only IPv4, your device may send DNS lookups, and other traffic, over IPv6 directly, outside the tunnel.

Manually configured DNS servers

If you’ve set a specific DNS server on your device or network adapter, some VPN setups keep sending lookups there. The same can happen when your device uses the router for DNS: queries to the router usually stay on your local network, outside the tunnel, and the router passes them to your ISP.

Browser secure DNS settings

Browsers can use DNS over HTTPS (DoH), which encrypts lookups and sends them straight to the browser’s chosen DNS provider, bypassing your system’s resolver and the VPN’s. The lookups are encrypted, so this is milder than a classic leak, but a leak test will show the browser’s provider instead of your VPN’s, and that provider sees every name you look up.

VPN misconfiguration

Manual setups are a common culprit. A WireGuard configuration file without a DNS = line, for example, leaves your system using whatever resolver it had before, often your router or ISP. Some older or poorly built apps also fail to set DNS correctly on every platform.

Sleep, wake and network changes

When your laptop wakes up or your phone switches from Wi-Fi to mobile data, the system picks up fresh network settings, including new DNS servers. Until the VPN reconnects and reapplies its own settings, lookups can go to the new network’s resolver.

How to run a DNS leak test

A DNS leak test makes your browser look up a series of unique, randomly generated addresses that only the testing service can answer, then reports which resolvers asked on your behalf.

1. Get a baseline. With your VPN off, search for a DNS leak test, open a reputable one and run the extended test. Note the resolvers listed; they’ll usually belong to your ISP, or to a DNS service you chose.
2. Connect your VPN. Wait until the app says it’s connected, then confirm your IP address shows the VPN location.
3. Run the extended test again. It sends many more lookups than the standard test, so it catches leaks that happen only some of the time.
4. Read the results. Every resolver listed should belong to your VPN provider, or to a DNS service your VPN says it uses. If your ISP’s name appears, or any resolver from your baseline shows up, you have a leak.
5. Repeat where it matters. Test in each browser and on each device you use, and again after waking from sleep or switching networks.

Check which DNS servers your system uses

Comfortable with a terminal? You can see which DNS servers your system uses with ipconfig /all on Windows (look for DNS Servers under each adapter), scutil --dns on macOS, or resolvectl status on Linux systems that use systemd-resolved. A router or ISP address on an adapter other than the VPN isn’t automatically a leak, but it shows where one could come from.

How to fix a DNS leak

Work through these fixes from easiest to most involved, and rerun the extended test after each one.

1. Reconnect and update. Disconnect, reconnect and test again; after sleep or a network change, that may be all it takes. Then update the VPN app and your operating system.
2. Use your VPN provider’s own app. Official apps usually configure DNS for you. If the app has a setting for using the VPN’s DNS or preventing leaks, turn it on.
3. Remove custom DNS settings. Set your network adapter’s DNS back to automatic so the VPN can apply its own. With a manual WireGuard or OpenVPN configuration, make sure it specifies your provider’s DNS server, such as the DNS = line in a WireGuard file.
4. Check your browser’s secure DNS setting. In Chrome, it’s typically under Settings > Privacy and security > Security > Use secure DNS; in Firefox, look in Settings > Privacy & Security for DNS over HTTPS. If it’s set to a specific provider, turn secure DNS off while the VPN is on, or accept that the provider will see your lookups.
5. Deal with IPv6. If your VPN doesn’t support IPv6, turning IPv6 off on your network adapter is a common workaround; on Windows, it’s a checkbox in the adapter’s properties. Turn it back on if anything stops working.
6. Turn off smart multi-homed name resolution (advanced). On Windows Pro and Enterprise editions, the Group Policy setting Turn off smart multi-homed name resolution, under Computer Configuration > Administrative Templates > Network > DNS Client, reduces Windows’ habit of querying every adapter. Only change it if you’re comfortable with Group Policy.
7. Try another protocol or app. If the leak survives all this, switch protocols or try a different VPN; one that leaks after a clean setup isn’t doing its job.

IPv6 and WebRTC leaks: two more to check

A clean DNS leak test doesn’t mean everything is sealed. Check two related leaks too, noting that a WebRTC leak exposes IP addresses rather than DNS queries.

WebRTC is the browser technology behind in-page video calls. To connect people directly, it discovers your device’s IP addresses, and in some setups it can reveal your real one to a website even with the VPN on. Our guide on how to check if your VPN is working walks through all three tests, and how to hide your IP address covers the bigger picture.

What a good VPN should do about DNS

A well-built VPN app should keep every DNS lookup inside the tunnel, handle or block IPv6, stop Windows from querying other adapters, and restore protection quickly after sleep or a network change. Still, don’t take any VPN’s word for it, including ours. Settings, updates and networks change, and the only way to know your lookups are staying in the tunnel is to test.

The bottom line

A DNS leak quietly sends your lookups outside the VPN tunnel, usually to your ISP, revealing the sites you visit. Checking takes a few minutes: get a baseline, connect, run the extended test and make sure no resolver belongs to your ISP. If one does, work through the fixes above, easiest first.

Run these checks with any VPN you use, including OqusFreeVPN, when you first install it and after major updates. OqusFreeVPN is 100% free, with no ads and no account needed. Apps for Windows, macOS, Android, iOS and Linux are rolling out in Early Access, and you can follow along on our download page.