What Is a DNS Leak (and How to Test for One)
A DNS leak can reveal your real location even while your VPN's IP address looks completely correct. Here's what actually causes it and how to test for one in under a minute.
Every time you visit a website, your device first has to translate its domain name into an IP address — a DNS lookup, sent to a DNS server before the actual connection ever starts. A VPN is supposed to route that lookup through its own encrypted tunnel and its own DNS servers, alongside everything else. A DNS leak is what happens when it doesn't: the lookup goes out through your normal, unencrypted network path instead, straight to your ISP's DNS server, even while the rest of your traffic is correctly tunneled through the VPN.[1]
This is a genuinely common problem, not an edge case: one study of VPN apps on the Google Play Store found that 84% of the 283 apps tested leaked DNS requests in at least one tested scenario. This guide covers exactly what causes that, why it can undermine a VPN connection that otherwise looks completely fine, and how to check whether your own connection is affected.[1]
Why a DNS leak matters even when your IP looks right
This is what makes DNS leaks easy to miss: checking "what's my IP" after connecting to a VPN can show the correct VPN server address, while a separate, parallel channel — DNS — is quietly resolving through your ISP the entire time. Your ISP's DNS logs then show every domain you looked up, in order, timestamped — which, in practice, is close to a full browsing history, independent of whatever your IP address appeared to be.
The four common causes
1. Windows' Smart Multi-Homed Named Resolution
Starting with Windows 8, Microsoft added a feature that queries DNS across every available network interface simultaneously and uses whichever responds fastest — a genuine speed optimization for ordinary use, and a direct DNS leak the moment a VPN is active, because your normal network adapter is still one of the interfaces being queried, and its DNS server has no idea it's supposed to be bypassed.[1]
2. Split-tunnel configurations
If DNS resolution isn't explicitly included in a split-tunnel policy, it can resolve outside the tunnel even while the app traffic you specifically chose to protect is routed correctly. This is worth checking deliberately if you use split tunneling for any reason — it's specifically named as a cause, not just a theoretical risk.[1]
3. A VPN client that simply doesn't force DNS through the tunnel
Not every VPN app is built to override your operating system's existing DNS configuration — some only tunnel general traffic and leave DNS resolution pointed wherever your network settings already had it pointed, which was your ISP's server before you ever opened the app. This is the most direct explanation for that 84% figure: it's an implementation gap, not a rare misconfiguration.[1]
4. IPv6 traffic the VPN doesn't tunnel
Many VPN clients tunnel IPv4 traffic thoroughly but don't handle IPv6 the same way. On a network with IPv6 enabled, DNS and other traffic can resolve over IPv6 outside the tunnel entirely, invisible to an IPv4-only VPN client and invisible to an IPv4-only leak check. Disabling IPv6 at the OS level, or confirming a VPN specifically tunnels IPv6 too, closes this gap.
How to actually test for one
- Connect to your VPN and pick a server in a different country than you're actually in
- Visit a DNS leak testing site (dnsleaktest.com is the standard, widely used tool) and run the extended test, not just the quick one
- Check the results: every DNS server listed should belong to your VPN provider. If your actual ISP or its country shows up in the list, DNS is leaking
- If it leaks, enable "DNS leak protection" in your VPN's settings if available, and re-test — most mainstream providers ship this as a toggle specifically because the problem is this common
Test after every major change, not just once
A connection that passed a DNS leak test last month isn't guaranteed to pass today — an OS update, a new split-tunneling rule, or a VPN app update can all reintroduce a leak. Re-test after any of those, and periodically regardless, rather than treating a single clean result as permanent.
How this differs from an IP leak
A DNS leak and an IP leak (via WebRTC, for instance) are separate failure modes that happen to produce a similar result — your real location becoming visible despite an apparently correct VPN connection. An IP leak exposes your actual public IP address directly; a DNS leak exposes which DNS servers you're actually using, which points to your ISP and country just as clearly, through an entirely different channel. Fixing one doesn't fix the other, which is why a thorough VPN check tests both separately rather than assuming a clean IP check means everything is protected.
Compare VPNs with verified DNS leak protection
Our privacy rankings check whether DNS leak protection is on by default, not just listed as a feature.
Compare privacy-focused VPNs →Common questions
Can a DNS leak happen even if my VPN's IP address checks out fine?
Does every VPN leak DNS?
Why did my DNS leak test pass last week and fail today?
Sources
- [1]Wikipedia — DNS leak· verified 2026-08-05
- [2]Wikipedia — Split tunneling· verified 2026-08-05
Related guides
What Is Split Tunneling and When Should You Use It
Split tunneling routes only chosen apps through your VPN while everything else goes direct. Here's how it actually works, why it fixes VPN slowdowns, and the trade-off it quietly makes in exchange.
What Is a VPN Kill Switch and How Does It Actually Work
A kill switch closes the brief gap when your VPN drops and your traffic would otherwise fall back to your real IP. Here's the actual mechanism behind it, and why some implementations are far weaker than others.
How Streaming Services Detect and Block VPNs
Netflix, BBC iPlayer, and Prime Video block VPN traffic to different degrees. Here's what they actually check for, and why a "streaming-optimised" server works when a regular one doesn't.