TECHNICAL GUIDE • October 2026 • 8 min read

DNS Leaks Explained: How to Test for One and Fix It

Your VPN says it is connected, but your lookups may still be going to your ISP. Here is how to check, and how to fix it.

Short answer: A DNS leak happens when your device asks your internet provider's servers, instead of the VPN's, to look up website names while the VPN is on. It lets your ISP see which sites you visit even though the content is encrypted. You test for it with an independent leak-test site, and you fix it with your VPN's DNS protection setting, a kill switch, and a few device-level changes.

A VPN promises that the network between you and the internet cannot see where you go. DNS is one of the quiet places where that promise can break. This guide explains the problem in plain language, shows you how to test your own setup in a few minutes, and lists the fixes in the order worth trying.

What DNS is, and why it can leak

DNS is the internet's phone book. When you type a site name, your device asks a DNS server to turn the name into an address before it can connect. Those lookups reveal every site you visit, even if the pages themselves are encrypted.

With a working VPN, those lookups should travel inside the encrypted tunnel to a DNS server run by or chosen by the VPN. A DNS leak is when some lookups skip the tunnel and go out the normal way, to your ISP's resolver or whatever DNS server your router or operating system is configured to use. Your IP address might look correct on a basic IP-check site while your DNS requests still point back to your real provider.

Why it matters

Your ISP can still see your browsing history in the form of site names. That is the very thing many people buy a VPN to avoid. Our guide to what your ISP can see with and without a VPN explains the difference.
It can undermine location tricks. If a service sees DNS requests that do not match your VPN location, it can be a clue that you are using a VPN.
It gives a false sense of security. The VPN app says "connected", so you assume everything is covered.

A DNS leak is not the same thing as your IP address leaking, and it is not the same as a WebRTC leak (a browser feature that can reveal addresses). They are separate problems with separate tests.

Common causes

The operating system keeps using its own DNS. Some systems send lookups through every available network adapter at once, which can include your normal connection.
IPv6 is not tunneled. If the VPN only handles IPv4, IPv6 lookups and traffic can bypass it.
The VPN connection drops or reconnects. For a few seconds, traffic uses the normal route. A kill switch exists to prevent this, and our kill switch explainer shows how it works.
Split tunneling is set up to exclude apps or sites. Excluded traffic uses normal DNS by design.
Browser secure DNS settings. If your browser sends DNS over HTTPS to its own chosen provider, that bypasses both your ISP and the VPN's resolver. That may not expose you to your ISP, but it is not what the VPN is configured to do.
Manual DNS settings on your device or router. A custom DNS address set in your network settings can override the VPN's choice.

How to test for a DNS leak

Take a baseline without the VPN. Open an independent DNS leak test site (search for "DNS leak test" and pick one from a reputable security or privacy organization) and run the standard test. Note the servers and the company names it lists. These are your ISP's resolvers.
Connect the VPN. Use the server you normally use and wait until the app says it is connected.
Run the same test again. The results should show DNS servers belonging to your VPN provider or a DNS company you have chosen on purpose, not your ISP.
Repeat in each browser and on each device. A fix on one machine does not carry over to another.
Test during a reconnect. Switch Wi-Fi off and on while the VPN is running, then test again. This checks that the kill switch does its job.

How to read the result: If you see your ISP's name in the results with the VPN on, you have a leak. If you see a third-party DNS provider you configured yourself, it may be fine, but it is not covered by your VPN's own DNS. If you see the VPN provider's name or an unfamiliar name tied to your VPN, you are probably protected.

How to fix it, in order

Turn on the VPN's own DNS leak protection. Many apps have a setting for this, sometimes under advanced or security options. Wording and location vary by provider, so check the provider's help pages.
Enable the kill switch. This covers reconnect gaps.
Remove manual DNS overrides. Set your device's network adapter back to automatic DNS, and check your router's DNS settings as well.
Handle IPv6. Pick a VPN app that supports IPv6 properly, or disable IPv6 on your network adapter as a workaround. Disabling it can affect other things, so note the setting you change in case you need to undo it.
Check browser secure DNS. Decide whether your browser's DNS-over-HTTPS setting should be off while the VPN is on, so lookups follow the VPN's configuration.
Check split tunneling. Make sure the apps you care about are inside the tunnel.
Try a different protocol. Switching between WireGuard and OpenVPN in the app can change how DNS is handled. Our VPN protocols comparison explains the options.
Update the app, then contact support. A leak that persists after the steps above is worth reporting to the provider, with your test results.

For general connection problems, see our VPN not connecting guide.

Picking a VPN with leak protection

When you compare providers, look for DNS leak protection as a named feature, a kill switch available on the platforms you use, and IPv6 handling that is clearly documented. Do not rely on a marketing line. Run the test above during your money-back window and keep the results. Our buying checklist covers the other items worth confirming, and what a no-logs policy means helps you judge what the provider does with DNS requests on its side. Both providers we have affiliate links for are covered in NordVPN vs Surfshark.

Run the test during the refund window

A VPN you have verified yourself beats one you merely trust. Affiliate links; see the disclosure at the top.

Visit NordVPN →Visit Surfshark →

Frequently Asked Questions

What is a DNS leak?

A DNS leak is when your device sends website lookups to your ISP's or another outside DNS server instead of through the VPN tunnel, so your ISP can still see which sites you visit.

How do I know if my VPN has a DNS leak?

Run an independent DNS leak test with the VPN off, note the servers, then run it again with the VPN on. If your ISP's servers still appear, you have a leak.

Does a kill switch stop DNS leaks?

It helps by blocking traffic when the VPN drops, which prevents leaks during reconnects. It does not fix a leak caused by settings such as manual DNS, IPv6 or split tunneling.

Is a DNS leak the same as an IP leak?

No. An IP leak shows your real address to websites. A DNS leak exposes the lookups for sites you visit. A WebRTC leak is a third, browser-based problem. Each has its own test.

Should I disable IPv6 to stop leaks?

It can be a workaround if your VPN does not handle IPv6, but it may affect other connections. A VPN app that properly supports IPv6 is the cleaner solution.

Sources and verification note: Explained from general DNS and VPN behaviour. No provider-specific setting names, menu paths or leak-protection claims are stated, because they vary by app and version. Use a reputable independent leak-test site and your provider's current help pages to confirm your own result.