DNS Leak Test: What It Means and How to Fix It

🌊

Why DNS Privacy Is the Foundation of Online Privacy

Before your browser can load any website, it must first translate the domain name — like google.com — into a numerical IP address. This translation happens through the Domain Name System (DNS). Every website visit generates at least one DNS query, often more. These queries are a complete log of every site you visit, every service you use, and every domain your apps connect to in the background.

By default, DNS queries are sent to your ISP's DNS servers in unencrypted plaintext. This means your ISP can see — and in many countries, is required to log — every website you visit. In some jurisdictions, ISPs sell this browsing data to advertisers. Governments can subpoena it. Hackers on your network can intercept it. DNS privacy is not a theoretical concern; it's a practical issue affecting every internet user.

What Is a DNS Leak and Why Is It Dangerous?

When you use a VPN, the expectation is that all your internet traffic — including DNS queries — routes through the VPN's encrypted tunnel. The VPN provider's DNS servers handle your queries, and your ISP sees only encrypted traffic going to the VPN endpoint. A DNS leak breaks this expectation: DNS queries bypass the VPN tunnel and go directly to your ISP's DNS servers instead.

The result is a critical privacy gap: even with your VPN active, your ISP can still see every domain you're accessing. The VPN protects your traffic content but the DNS leak reveals your browsing activity. For users relying on VPNs for privacy — in countries with surveillance concerns, for journalists protecting sources, or for anyone who simply values privacy — a DNS leak completely undermines the purpose of using a VPN.

Types of DNS Leaks

DNS leaks occur through several different mechanisms, and comprehensive testing needs to check for all of them:

Standard DNS leak: The most common type. Your operating system ignores the VPN's DNS settings and sends queries to the system-default DNS server (your ISP's server) through the normal network interface rather than through the VPN tunnel. This happens with many VPN clients that don't correctly override OS DNS settings.
WebRTC IP leak: WebRTC (Web Real-Time Communication, used for browser-based video and audio calls) uses STUN (Session Traversal Utilities for NAT) servers to discover public IP addresses. These STUN requests bypass VPN tunnels and can reveal both your real public IP address and your local network IP. This is one of the most common and dangerous leak types, affecting Chrome and Firefox particularly.
IPv6 DNS leak: Many VPNs tunnel only IPv4 traffic. If your ISP has assigned you an IPv6 address (increasingly common), all IPv6 DNS queries and traffic route completely outside the VPN tunnel — invisible to the VPN but fully visible to your ISP.
Transparent DNS proxy (ISP interception): Some ISPs intercept all outbound DNS traffic at the network level and redirect it to their own DNS servers, regardless of what DNS server your device is configured to use. This is particularly prevalent in regions with active internet censorship or ISP-level tracking requirements.
Teredo/6to4 tunneling leaks: IPv4-to-IPv6 transition technologies can create secondary network interfaces that bypass VPN routing rules.
Split tunneling DNS leaks: If your VPN client uses split tunneling (routing some traffic through the VPN and some directly), the direct-traffic routes may use different DNS settings than the tunneled routes.

How to Test for DNS Leaks Thoroughly

A complete DNS leak test requires checking all potential leak vectors, not just the basic DNS server check:

Establish a baseline. Before connecting to your VPN, run a DNS leak test to document which DNS servers and IP addresses appear normally. This gives you a reference point for comparison.
Connect to your VPN. Choose a VPN server location that's clearly geographically distinct from your actual location — this makes leaks obvious in the results.
Run a multi-vector DNS leak test. A thorough test should use multiple test servers simultaneously, check for both IPv4 and IPv6 exposure, specifically test for WebRTC leaks through the browser, and verify all DNS queries resolve through expected VPN infrastructure.
Review DNS server names in the results. You should see DNS servers belonging to your VPN provider, not your ISP. If you recognize your ISP's name anywhere in the results, you have a standard DNS leak.
Check for IP address leaks separately. Your displayed IP should match the VPN server's IP, not your real public IP. Compare against your baseline.
Test WebRTC specifically. Many general DNS tests don't check for WebRTC leaks — use a dedicated WebRTC leak test to verify your browser isn't exposing your real IP through this vector.

⚠️ Beware of misleading tests: Some VPN providers offer "built-in" DNS leak tests that only check their own DNS server configuration — they're designed to show you a passing result rather than thoroughly verify your privacy. Use independent third-party testing tools for accurate results.

How to Fix DNS Leaks: Complete Remediation Guide

The right fix depends on which type of leak you're experiencing:

For standard DNS leaks: Switch to a VPN client with built-in DNS leak protection that automatically routes all DNS through the tunnel and prevents OS-level DNS queries from bypassing it. Quality VPN clients like Mullvad, ProtonVPN, and NordVPN include this by default. Alternatively, use a VPN with a kill switch that blocks all internet access if the VPN connection drops, preventing DNS queries from defaulting to your ISP.
For WebRTC leaks: In Firefox, navigate to about:config and set media.peerconnection.enabled to false. In Chrome, install the WebRTC Network Limiter extension or switch to a Chromium-based browser with built-in WebRTC control (Brave, for example, includes a WebRTC handling option in privacy settings).
For IPv6 leaks: Either use a VPN that fully supports IPv6 tunneling, or disable IPv6 entirely on your network adapter. On Windows: Network Adapter Properties → uncheck "Internet Protocol Version 6 (TCP/IPv6)." On Linux: add net.ipv6.conf.all.disable_ipv6 = 1 to /etc/sysctl.conf.
For ISP transparent proxy interception: Configure DNS over HTTPS (DoH) or DNS over TLS (DoT) in your browser and OS settings. DoH encrypts DNS queries within HTTPS traffic, making ISP-level interception and redirection technically impossible. Firefox and Chrome both support DoH in their settings; Windows 11 supports DoT at the OS level.
For split tunneling leaks: Review your VPN's split tunneling configuration. Either disable split tunneling entirely or carefully ensure that DNS handling is consistent for both tunneled and direct-traffic routes.

DNS Encryption Options: DoH vs. DoT vs. DNSSEC

Understanding the DNS encryption landscape helps you choose the right protection even outside of VPN context:

DNS over HTTPS (DoH): Wraps DNS queries inside standard HTTPS traffic. ISPs and network intermediaries cannot distinguish DNS queries from regular HTTPS web traffic, making filtering and interception much harder. Supported natively in Firefox, Chrome, Edge, and Windows 11. Uses port 443 — the same as all HTTPS traffic — making it firewall-resistant.
DNS over TLS (DoT): Encrypts DNS queries using TLS, similar to HTTPS, but on a dedicated port (853). More transparent about what it's doing than DoH — network administrators can see DoT traffic and choose to block or allow it. Supported at the OS level in Android 9+ and Windows 11.
DNSSEC (DNS Security Extensions): Not an encryption solution — DNSSEC adds cryptographic signatures to DNS records to verify that responses haven't been tampered with in transit. Important for preventing DNS hijacking but doesn't prevent ISP visibility of your queries.

Recommended Privacy-Respecting DNS Providers

If you're configuring encrypted DNS independently of a VPN, choose a provider with a clear no-logs privacy policy and a track record of transparency:

Cloudflare 1.1.1.1: Fast, privacy-focused, independently audited. DoH: https://cloudflare-dns.com/dns-query
Quad9 (9.9.9.9): Swiss-based, blocks malicious domains, no personal data logging. DoH supported.
NextDNS: Highly configurable filtering with per-account logging controls and detailed analytics. Free tier available.
Mullvad DNS: For Mullvad VPN users — integrated and audited alongside the VPN service.

← Back to Blog Share on X →