When you use a VPN, your traffic is encrypted and routed through a VPN server. Your ISP should see only encrypted data to the VPN — not which websites you visit. But there is a catch: DNS. Domain Name System (DNS) is how your device translates domain names like example.com into IP addresses. Every time you visit a website, your device sends a DNS query to resolve the domain. If that query goes outside the VPN tunnel — to your ISP's DNS or another third-party DNS — your ISP can still see which sites you visit. That is a DNS leak.
A DNS leak undermines the privacy benefit of your VPN. You may think your browsing is private because your traffic is encrypted and your IP is masked. But if DNS queries leak, your ISP (and anyone who can see your DNS traffic) knows exactly which domains you requested. They can log that data, sell it, or share it. In some cases, DNS leaks can also expose your real IP address if the DNS server or a malicious actor correlates the query with your connection.
This guide explains what DNS is, why DNS leaks matter, what causes them, how to test for them, and how to fix them. Whether you are new to VPNs or a long-time user, testing for DNS leaks should be part of your routine. A VPN that leaks DNS is not providing the privacy you expect. The following sections cover DNS basics, leak causes, testing methods, and remediation in detail.
DNS leaks are common. Many users assume their VPN handles DNS correctly without testing. A single leak test takes under a minute. Run one now, then add it to your monthly security routine. Catching a leak early prevents months of exposed browsing. Some VPNs leak DNS only on certain platforms or in specific configurations. Test on every device you use — desktop, laptop, phone, tablet. A leak on one does not mean a leak on all.
Encrypted DNS (DoH, DoT) does not replace VPN DNS handling. DoH encrypts queries to a third-party resolver, but that resolver still sees your requests. A VPN routes DNS through its own servers inside the tunnel — your ISP and third-party resolvers see nothing. For VPN users, the VPN should own DNS.
Looking for a reliable VPN?
KloudVPN — from $2.83/month. Apps for every device.
What Is DNS and Why It Matters for VPN
DNS translates human-readable domain names into IP addresses. When you type "example.com" into your browser, your device sends a DNS query to resolve that name. The query goes to a DNS server — often your ISP's by default. The DNS server responds with the IP address, and your device connects to that IP.
When you use a VPN, the goal is for all traffic — including DNS — to go through the VPN tunnel. The VPN provider typically operates its own DNS servers. Your device should send DNS queries through the VPN to those servers. Your ISP would then see only encrypted traffic to the VPN; they would not see the DNS queries or the domains you request. If DNS queries go to your ISP's DNS (or any DNS outside the tunnel), that is a leak.
What DNS Reveals
DNS queries reveal which domains you are trying to reach. Even if the actual connection to the website is encrypted (HTTPS), the DNS query happens first and is often unencrypted (though DNS over HTTPS and DNS over TLS are changing that). Your ISP can see: you requested example.com, bank.com, health-site.com. That is a detailed log of your browsing activity.
Why VPNs Must Handle DNS
A VPN that does not handle DNS correctly is incomplete. The VPN encrypts your traffic and routes it through their server — but if DNS goes elsewhere, the encryption and routing are partially defeated. A proper VPN forces all DNS queries through the tunnel to the VPN's DNS servers. The VPN provider can then resolve domains without your ISP seeing the queries.
How DNS Works with a VPN
Understanding the normal flow helps you spot when it breaks.
The Ideal Path
When you visit a site, your device sends a DNS query to resolve the domain. With a VPN, that query should go through the VPN tunnel to the VPN provider's DNS servers. Your ISP never sees it. The VPN server resolves the domain and returns the IP; your traffic then goes to that IP through the tunnel.
When the Path Breaks
A leak occurs when the DNS query goes outside the tunnel — to your ISP's DNS, Google's 8.8.8.8, or another third-party resolver. The query may be sent before the VPN is fully established, or the VPN client may fail to override the system DNS. Either way, your ISP or the third-party sees which domains you requested.
What Causes DNS Leaks
DNS leaks occur when DNS queries bypass the VPN tunnel. Several factors can cause this.
Misconfigured VPN Client
Some VPN clients do not properly route DNS through the tunnel. They may leave the system's default DNS in place, or they may fail to override DNS settings on certain platforms. This is a VPN provider issue — a well-designed client forces DNS through the tunnel.
IPv6 and DNS
Many networks now use IPv6. If your VPN tunnels only IPv4 traffic, IPv6 traffic — including IPv6 DNS queries — may go outside the tunnel. That is an IPv6 leak, which can include DNS. A good VPN either blocks IPv6 or tunnels it.
Split Tunneling
If you use split tunneling and exclude certain apps, those apps may use the system DNS instead of the VPN's DNS. Their DNS queries go to your ISP. This is expected behavior for excluded apps — but it means you should not exclude sensitive apps, or you should understand that their DNS is exposed.
Operating System Behavior
Some operating systems have multiple network interfaces and complex routing. On Windows, for example, certain features (like "smart multi-homed name resolution") can send DNS queries to multiple servers, including ones outside the VPN. A VPN client must account for these behaviors.
Network Configuration
Some networks push DNS settings via DHCP or other mechanisms. If the VPN does not override these, the device may use the network's DNS. This is common on corporate or university networks where the network administrator controls DNS.
Why DNS Leaks Matter for Privacy
A DNS leak means your ISP (and potentially others) can see which domains you visit. That undermines the core privacy promise of a VPN.
ISP Logging
In many countries, ISPs are permitted to collect and log DNS queries. They can build a profile of your browsing habits, sell that data to advertisers, or share it with law enforcement. A VPN is supposed to prevent that. A DNS leak means it does not.
Correlation with Your Identity
DNS queries are tied to your connection. Even if the VPN masks your IP for the actual website connection, a leaked DNS query can be correlated with your real IP by your ISP. In some cases, this can reveal your identity or location.
Public WiFi
On public WiFi, DNS queries may go to the network's DNS server or be visible to other users. A leak means the WiFi operator — or an attacker on the network — can see which sites you visit. That is a significant privacy and security risk.
How to Test for DNS Leaks
Testing for DNS leaks is straightforward. Connect to your VPN, then run a DNS leak test. The test will show which DNS servers resolved the test domain. If you see your ISP's DNS or any server that is not your VPN's, you have a leak.
Using a DNS Leak Test Tool
Visit a DNS leak test site (such as dnsleaktest.com or the KloudVPN DNS leak test tool) while connected to your VPN. The test makes DNS requests and reports which servers responded. All responding servers should be operated by your VPN provider. If you see servers from your ISP, Google, Cloudflare (unless your VPN uses them), or other third parties, you have a leak.
What to Look For
The test will list DNS server IPs and sometimes their hostnames or organizations. Your VPN provider's DNS servers should be the only ones that appear. If the test shows servers in your actual location (your country, your ISP) when you are connected to a VPN server in another country, that is a strong indicator of a leak.
Extended Tests
Some tests run multiple queries to simulate real browsing. Run an extended test to increase confidence. DNS leaks can be intermittent — a single test might miss them. Test periodically, especially after OS updates, VPN app updates, or network changes.
How to Fix DNS Leaks
If you detect a DNS leak, there are several steps you can take.
Use a VPN That Prevents Leaks
The primary fix is to use a VPN that properly handles DNS. A good VPN client forces all DNS through the tunnel and uses the VPN provider's DNS servers. If your current VPN leaks, consider switching to one with a proven no-leak design. KloudVPN routes all DNS through the VPN.
Enable DNS Leak Protection
Some VPN apps have a "DNS leak protection" or "Block DNS outside VPN" option. Enable it. This setting forces the system to use only the VPN's DNS when the VPN is connected.
Disable IPv6
If the leak is caused by IPv6, disabling IPv6 on your device can stop it. This is a workaround, not a fix — a proper VPN should handle IPv6. But if your VPN does not, disabling IPv6 prevents IPv6 DNS from leaking.
Check Split Tunneling
If you use split tunneling, excluded apps will use the system DNS. That is expected. If you want full DNS protection, use a full tunnel — do not exclude apps that do DNS lookups.
Manual DNS Configuration
On some platforms, you can manually set your DNS to the VPN provider's DNS servers when the VPN is connected. This is fragile — the VPN app should handle it automatically. Use manual configuration only if the VPN app does not fix the leak and you cannot switch providers.
DNS Leak Prevention by Platform
Different operating systems handle DNS differently. VPN clients must account for platform-specific behavior.
Windows
Windows has "smart multi-homed name resolution" which can send DNS to multiple servers. A good VPN client overrides this and forces DNS through the tunnel. Test on Windows — leaks are common if the VPN does not fully integrate with Windows networking.
macOS and iOS
Apple devices use system-level DNS resolution. VPN apps that use the Network Extension framework can intercept DNS. Test after each iOS or macOS update — Apple sometimes changes networking behavior.
Android and Linux
Android and Linux allow per-interface DNS. VPN clients that create a virtual interface should route DNS through it. Some custom ROMs or network managers can override VPN DNS — test on your specific setup.
DNS Leak Impact on Streaming and Geo-Restrictions
A DNS leak can affect more than privacy. It can break geo-restriction bypass and streaming.
Streaming and Content Access
When you use a VPN to access region-locked content, the streaming service checks your IP and sometimes your DNS. If DNS leaks to your ISP, the service may detect a mismatch — your IP says you are in the US, but your DNS says you are elsewhere. That can trigger blocks or limit content. A leak-free VPN ensures consistent geo-access.
Banking and Fraud Detection
Some banks and payment processors use IP and DNS to detect fraud. A DNS leak can create inconsistent signals — your connection appears from one location, your DNS from another. That may trigger security checks or block transactions. For banking, a leak-free VPN is essential.
DNS over HTTPS and DNS over TLS
Traditional DNS is unencrypted. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries between your device and the DNS server. They protect against eavesdropping on the path — but they do not replace a VPN's DNS handling.
If you use DoH or DoT with a third-party provider (e.g. Cloudflare, Google) while your VPN is connected, your DNS may go to that provider instead of the VPN's DNS. The VPN might not see it; your ISP might not see it; but the DoH/DoT provider sees it. For VPN users, the cleanest approach is to let the VPN handle DNS — use the VPN's DNS servers through the tunnel. Do not configure separate DoH/DoT if it bypasses the VPN.
VPN DNS vs DoH
A VPN that handles DNS sends your queries through the encrypted tunnel to the VPN's DNS servers. That protects you from your ISP. DoH encrypts DNS to a third-party provider — but that provider then sees your queries. For VPN users, VPN DNS is the right choice.
DNS Leak and Browser Extensions
Browser extensions can affect DNS routing. Some extensions use their own DNS or proxy settings.
VPN Browser Extensions
VPN browser extensions protect only browser traffic. They may use different DNS than your system VPN. If you use both a system VPN and a browser extension, ensure they do not conflict. Prefer a full system VPN for complete DNS protection.
Ad Blockers and Privacy Extensions
Some ad blockers or privacy extensions route DNS through their own resolvers. That can bypass your VPN's DNS. Check extension settings — disable "use our DNS" or similar if you want all DNS to go through the VPN.
Secure DNS Extensions
Extensions that enable DNS over HTTPS (DoH) may send DNS to Cloudflare, Google, or another provider instead of your VPN. For VPN users, let the VPN handle DNS. Disable DoH extensions when the VPN is active, or use a VPN that integrates DoH within the tunnel.
Testing Best Practices
Test for DNS leaks regularly. Circumstances change — OS updates, VPN app updates, and network changes can introduce leaks.
When to Test
Test when you first set up your VPN, after any VPN or OS update, when you change networks (e.g. switch from WiFi to Ethernet, or join a new WiFi), and periodically (e.g. monthly) as a routine check.
Test on Multiple Servers
Connect to VPN servers in different countries and run the test each time. Some leaks may be server-specific or routing-specific. If you use split tunneling, test with it enabled and with your typical configuration.
Document Results
If you find a leak, note the conditions: which server, which network, which OS version. That helps when reporting to your VPN provider or troubleshooting. Keep a log if leaks recur — patterns help identify root causes.
Key Takeaways
A DNS leak occurs when DNS queries go outside the VPN tunnel, allowing your ISP to see which sites you visit. Causes include misconfigured VPN clients, IPv6, split tunneling, OS behavior, and browser extensions that use their own DNS. Test regularly using a DNS leak test tool — all DNS should go through your VPN. Fix leaks by using a VPN that prevents them, enabling DNS leak protection, or disabling IPv6 if necessary. A good VPN routes all DNS through the tunnel. Test periodically to ensure your VPN remains leak-free.
Key Takeaways
A DNS leak defeats the privacy purpose of a VPN. Your traffic may be encrypted and your IP masked, but if DNS queries go to your ISP, they can still see which sites you visit. That is not acceptable for anyone who uses a VPN for privacy.
Test for DNS leaks regularly. Connect to your VPN, run a DNS leak test, and verify that only your VPN's DNS servers appear. If you see your ISP or other third parties, you have a leak. Fix it by switching to a VPN that handles DNS correctly, enabling leak protection, or addressing IPv6 or split tunneling issues.
A good VPN prevents DNS leaks by design. Do not assume yours does — test and verify. Your privacy depends on it. Bookmark a DNS leak test tool and run it whenever you change VPN servers, networks, or devices. Consistency matters more than a one-time check. If you use multiple VPN servers or switch between networks often, test after each change. A leak can be server-specific or network-specific. Add a DNS leak test to your monthly security checklist alongside password reviews and app updates. The habit takes 60 seconds; the protection is ongoing.
Related Resources
Frequently Asked Questions
KloudVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloudVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.