DNS leak test (and quick fixes)
Your VPN says “Connected.” The icon is green. But every time you open a website, your device still quietly asks your internet provider, “Where do I find this site?” That is a DNS leak: your lookups slip outside the tunnel even though everything looks fine. The good news is that it takes about a minute to catch, and most fixes are a single toggle.
What a DNS leak is, in plain English
DNS is the internet’s phone book. Every time you open a site, your device looks up its name — say, “example.com” — and gets back the number it actually connects to. When your VPN works correctly, that lookup travels through the encrypted tunnel and is answered by the VPN’s own DNS servers. Your internet provider never sees it.
A DNS leak happens when those lookups escape the tunnel and go to your provider instead. Your traffic might still be encrypted, but the list of sites you ask about is not private. It is a bit like sealing your letters in envelopes but reading the addresses out loud to the mail carrier.
Leaks usually come from a small set of causes: the VPN app is not forcing its own DNS, your device falls back to the network’s DNS, or an older internet standard called IPv6 sneaks lookups around the tunnel. None of these mean your VPN is broken — just that one setting needs a nudge.
How to test for a DNS leak
You do not need any technical skill for this. The whole point of a leak test is to compare two things: the network you are actually on, and the network the test thinks is answering your DNS. If they match your VPN, you are fine. If they match your real provider, you have a leak.
- Connect your VPN
Open your VPN app and connect to a server, ideally one in a different country from where you live. That makes a leak easy to spot.
- Run a leak and IP check
Open a reputable DNS leak test in your browser and run a standard test. Then confirm your visible address with our own IP checker — or run the full VPN leak test — so you know what the world sees.
- Look at the DNS servers
Read the country and owner listed for each DNS server in the result. This is the part that matters — names and locations, not numbers.
- Compare and repeat
Reconnect or switch servers and run the test again. Two or three clean results in a row are far more reassuring than one.
What the result means
A clean result shows DNS servers that belong to your VPN provider, or to a resolver the VPN clearly uses on purpose. The country usually matches the server you connected to, not your living room.
A leak shows your home internet provider, your hotel or café Wi-Fi network, or your mobile carrier sitting in the DNS list. If you connected to a server in another country but the result still names your local provider, that is the leak. Note it and move to the fixes below.
Quick fixes to try
Work through these in order and re-run the test after each one. Most people are clean again within the first two.
- Enable VPN DNS. Turn on “use VPN DNS” or “DNS leak protection” in your app’s settings. This is the single most common fix.
- Turn on the kill switch. It blocks all traffic — including stray lookups — the instant the tunnel drops. See What is a VPN kill switch? for how to set it up.
- Disable IPv6 if needed. If your app offers IPv6 leak protection, enable it; otherwise turning IPv6 off on your device stops lookups from slipping around the tunnel.
- Update the app. Old versions handle DNS less reliably. Install the latest build, then reconnect.
- Switch protocol. Change the connection protocol in settings (for example, between WireGuard and OpenVPN), reconnect, and test again.
Frequently asked questions
Is a DNS leak dangerous?
It will not expose your passwords or the contents of what you send, since that traffic is still encrypted. But it does reveal the list of sites you visit to your internet provider, which is exactly the privacy you turned on a VPN to keep. It is worth fixing.
Why does my VPN leak DNS?
Usually because the app is not forcing its own DNS servers, your device quietly falls back to the network’s DNS, or an older standard called IPv6 routes lookups around the tunnel. Each of these is a setting, not a broken VPN.
Does a kill switch stop DNS leaks?
A kill switch helps in one specific case: when the VPN drops, it blocks all traffic — including stray lookups — until the tunnel is back. It does not fix a leak that happens while you are connected, so pair it with your app’s DNS leak protection.
How often should I run a DNS leak test?
Once when you first set up a VPN, and again after any major change — a new app version, a different protocol, or new split tunneling rules. Otherwise a quick check every few months is plenty.