Explainer

What is a DNS leak?

Your VPN encrypts the traffic. A DNS leak means the questions that come before the traffic — “where is bank.com?” — still go to your internet provider, in the clear, tied to your account. The tunnel says connected. The record of every site you visit is being written anyway.

Test for a DNS leak

What causes it How to test How to fix it

Background

DNS is the internet’s phone book

Computers route to numbers, people remember names. Every time you open a site, your device first has to translate the name into an IP address, and it does that by asking a DNS resolver — normally the one your internet provider runs and assigns to you automatically.

That lookup happens before any encrypted connection exists, and traditional DNS is plain text. Whoever answers it learns the name of every site you are about to visit, when, and how often. They do not see the pages themselves, but the list alone is remarkably revealing: which bank you use, which health conditions you research, which employer’s webmail you check at 2am.

When you connect to a VPN, DNS lookups are supposed to travel inside the tunnel and be resolved by the VPN provider instead. A DNS leak is when that fails and your device keeps asking your provider’s resolver directly — outside the tunnel, in the clear, with your real IP address attached.

Causes

Why it happens

Hard-coded DNS settings

If a resolver was set manually on the adapter, in the router, or by another application, the operating system may keep using it in preference to the one the VPN pushes. The tunnel carries your traffic; the lookups go around it.

Smart Multi-Homed Name Resolution

A Windows feature that sends the same DNS query out of every network interface at once and uses whichever answers first. By design it asks your provider’s resolver even while a VPN is connected — and it has been the single most common cause of leaks on Windows for years.

IPv6 falling out of the tunnel

Plenty of VPNs tunnel IPv4 and quietly ignore IPv6. If your connection supports both, IPv6 lookups travel outside the tunnel with your real address attached, while everything on the IPv4 side looks perfectly clean.

Reconnect gaps

When the tunnel drops — waking from sleep, changing networks — the operating system reverts to its default resolver until the VPN re-establishes. Without a kill switch, that window can leak every lookup made during it.

Browser-level DNS

Browsers increasingly do their own DNS-over-HTTPS, independently of the operating system. Usually an improvement, but it means the browser can be resolving through a third party your VPN knows nothing about, and the two can disagree.

Transparent DNS proxying

Some networks and providers intercept all traffic on port 53 and answer it themselves regardless of which resolver you configured. You appear to be using 1.1.1.1; you are not. Only encrypted DNS defeats this.

Testing

How to check for one

Test with the VPN off

Open the DNS leak test and note the resolvers it reports. These should be your internet provider’s — that is your baseline.

Connect the VPN and test again

Run the same test. Every resolver listed should now belong to your VPN provider, and the country should match the server you chose.

Look for your provider’s name

If your ISP still appears anywhere in the results, you have a leak. Seeing both your VPN’s resolver and your provider’s is still a leak — the queries are being duplicated.

Check the other three

DNS is one of four. Run the WebRTC leak test and confirm IPv6 and kill-switch behaviour too. Any one of them undoes the others.

The fix is not something you should have to do manually. A VPN client should force every lookup through the tunnel, disable Smart Multi-Homed Name Resolution on Windows, either tunnel or block IPv6 rather than ignoring it, and hold traffic during reconnects. If you are editing adapter settings to stop your VPN leaking, the client is doing its job badly.

FAQ

Common questions

What does a DNS leak actually expose?

The name of every site you look up, the time you looked it up, and your real IP address alongside it. Not the page contents, and not what you typed — but the list of destinations is enough to reconstruct most of what someone would want to know about your browsing.

Can I have a DNS leak while the VPN says connected?

Yes, and that is the normal case. The VPN status only reports whether the tunnel is up. DNS resolution is handled by the operating system and can route around a perfectly healthy tunnel, which is exactly why leaks go unnoticed without testing.

Does a DNS leak reveal my real IP address?

To your DNS resolver, yes — the query arrives from your real address. Websites themselves still see the VPN server’s address, so it is not a full deanonymisation, but your internet provider ends up with a complete browsing log they should not have had.

Will changing my DNS to 1.1.1.1 fix it?

It moves the problem rather than solving it. Your queries stop going to your ISP and start going to Cloudflare, still outside the tunnel, still tied to your real address. It is an improvement in who sees the data, not in whether it leaks. Fixing the leak means getting the queries back inside the tunnel.

Is DNS-over-HTTPS enough on its own?

It encrypts the lookup so the network cannot read or tamper with it, which is genuinely valuable. It does not hide your IP address from the resolver, and it does not put the query inside your VPN tunnel. The two solve overlapping but different problems.

Test everything

DNS leak test WebRTC leak test What is my IP How to hide your IP address Full privacy check

Leak protection you can verify

LunoVPN resolves every lookup inside the tunnel, handles IPv6 rather than ignoring it, and holds traffic during reconnects. Test it against us before you pay.

Run the leak test Get LunoVPN