On this page
Definition
A DNS leak is a failure mode in which DNS lookup requests — the translations of domain names into IP addresses — are sent to a default, unencrypted DNS server outside the VPN tunnel, revealing browsing destinations despite an active VPN connection.
Simple explanation
Every time you visit a website, your device first asks a DNS server to translate the domain name (like example.com) into an IP address. When you're using a VPN, that lookup should also travel through the encrypted tunnel to the VPN's own DNS server.
A DNS leak happens when the operating system ignores the VPN and sends that lookup request straight to your regular internet provider's DNS server instead — meaning your provider can still see every site you're about to visit, even though your actual traffic is encrypted.
Why it matters
It quietly defeats a core reason people use a VPN in the first place: hiding browsing activity from their internet provider. The rest of the traffic may be perfectly encrypted while the site names themselves leak in plain sight.
DNS leaks are also easy to miss, because the VPN otherwise appears to be working — your IP address looks masked, and websites load normally, so there's no obvious sign that anything is wrong.
How it works
- 1Lookup requestYour device needs to resolve a domain name before connecting to it.
- 2Misrouted queryDue to misconfiguration, the request bypasses the VPN tunnel.
- 3Direct to ISPThe query goes straight to your default, often ISP-assigned, DNS server.
- 4ExposureThe DNS server operator (often your ISP) sees which domains you're resolving.
- 5Traffic still encryptedMeanwhile, the actual page content may still be encrypted, masking the leak's severity.
Real examples
Products named for illustration only. Inclusion is not an endorsement.
- dnsleaktest.comA widely used site for checking whether DNS requests are leaking outside a VPN tunnel.
- IPv6 leak scenarioA VPN handling only IPv4 traffic can still leak DNS over an active IPv6 connection.
- Windows 'Smart Multi-Homed Name Resolution'A known OS feature that has historically caused DNS leaks by querying multiple DNS servers simultaneously.
- Split-tunnel misconfigurationExcluding an app from the VPN tunnel can inadvertently route its DNS queries outside too.
Advantages
- Understanding DNS leaks helps you correctly evaluate whether a VPN is actually protecting your browsing.
- Modern VPN clients increasingly include built-in DNS leak protection as standard.
- Free online tools make leaks straightforward to detect without technical expertise.
- Fixing a leak is usually a configuration change, not a hardware or subscription issue.
Limitations
- Not all VPN apps enable DNS leak protection by default.
- IPv6 traffic is a common and easily overlooked leak source if the VPN only handles IPv4.
- Operating system-level settings can override VPN DNS configuration without obvious warning.
- Testing for leaks requires an extra manual step most users never take.
Common misunderstandings
- ClaimIf my VPN shows as connected, my DNS traffic must be protected too.RealityA VPN can display a 'connected' status while DNS queries still route outside the tunnel due to OS or app misconfiguration.
- ClaimDNS leaks only matter for advanced or technical users.RealityAnyone relying on a VPN for privacy is affected, since a leak exposes browsing destinations regardless of technical skill.
Frequently asked questions
How do I check for a DNS leak?
Connect to your VPN, then visit a dedicated DNS leak test site — it will show which DNS servers actually handled your requests.
Do all VPNs have DNS leak protection?
No — it varies by provider and platform, so check whether it's built in or needs to be manually enabled.
Can a firewall setting fix a DNS leak?
Yes — blocking DNS traffic that isn't routed through the VPN interface is a common and effective fix.
Is a DNS leak the same as an IP leak?
No — an IP leak exposes your actual IP address, while a DNS leak exposes which domains you're looking up; both undermine privacy differently.
Does using a VPN's own DNS servers guarantee no leak?
It significantly reduces the risk, but OS-level settings and IPv6 traffic can still bypass it without additional protection enabled.
The Tool Money Lab perspective
When we test VPNs, a DNS leak test is one of the first checks we run, because a provider can otherwise look fully protective on the surface while quietly exposing browsing activity underneath.
We treat built-in, enabled-by-default DNS leak protection as a meaningful quality signal — providers that leave it optional or absent are asking users to catch a subtle flaw themselves.
Conclusion
A DNS leak occurs when website-lookup requests slip outside an encrypted VPN tunnel, exposing your browsing destinations to your internet provider despite an active VPN connection.
It's a quiet failure mode that looks fine on the surface, which is why testing for it directly — rather than trusting a 'connected' status — is the only reliable way to confirm real protection.