DNS Leak
A DNS leak happens when your device sends DNS queries outside the VPN tunnel, exposing the sites you visit to your ISP despite using a VPN.
DNS Leak explained
Every time you visit a site, your device asks a DNS server to translate the domain into an IP address. A DNS leak occurs when those lookups bypass the VPN and go to your ISP resolver instead, revealing your browsing even though your traffic appears encrypted.
Good VPNs prevent this by routing DNS through their own resolvers inside the tunnel and by blocking system-level fallbacks. You can confirm protection with a DNS leak test, which shows whether your queries resolve through the VPN or your ISP.
Examples
- 01A leak test showing your ISP resolver instead of the VPN one
- 02Browsing history visible to an ISP despite an active VPN
- 03IPv6 requests escaping a VPN that only tunnels IPv4
Common use cases
Frequently asked questions
It is when your DNS lookups travel outside the VPN tunnel to your ISP resolver, exposing which sites you visit even though the rest of your traffic is encrypted.
Run a DNS leak test while connected to your VPN. If the resolver shown belongs to your ISP rather than the VPN, your DNS is leaking.
They route all DNS queries through their own resolvers inside the encrypted tunnel and block system fallbacks, so lookups never reach your ISP.
Yes. If a VPN only tunnels IPv4, IPv6 DNS requests can escape. Reputable VPNs either fully support or disable IPv6 to prevent this.
It mainly reveals the sites you look up to your DNS provider, but combined with other leaks it can help correlate activity to you, which is why it matters.
Ready to put this into practice?
See our independently-scored picks.