Articles and comparisons

DNS leak: what it is and why it matters with a VPN

Before your browser can open a site, it asks a DNS resolver for the site address. With a VPN those questions should go through the tunnel too. When they go to your internet provider instead, that is a DNS leak: the VPN hides your traffic, but your provider still sees which sites you look up.

How DNS works in short

Your device sends each name, such as example.com, to a resolver, usually the one your provider or router hands out. The resolver finds the address and remembers your question. Whoever runs the resolver can see the list of sites you visit, and the site operators can see which resolver asked on your behalf.

How a DNS leak test works

A test page makes your browser look up several random, never-used names on a domain whose name server the tester controls. That name server logs which resolvers asked. If those resolvers belong to your provider rather than to your VPN, your DNS leaks. This is why a DNS leak test needs a name server of its own, unlike most browser checks.

Why VPNs leak DNS

• The operating system keeps using the resolver from your router or provider instead of the one the VPN sets.
• IPv6 traffic, including DNS over IPv6, goes outside a tunnel that only handles IPv4.
• Split tunneling sends some traffic, sometimes DNS, outside the VPN.
• Some Windows versions send DNS questions over every network adapter at once to get a faster answer.
• Browser extensions sold as VPNs only proxy browser traffic; name lookups may still use the system resolver.

Encrypted DNS in browsers

Firefox, Chrome and other browsers can use DNS over HTTPS. Then lookups go encrypted to the DoH provider you chose instead of your internet provider. That hides them from your provider, but it is still a third party, and it is not the same as sending DNS through the VPN. A leak test will show the DoH provider resolvers.

How to fix a leak

• Use a VPN app that routes all traffic and has DNS leak protection turned on.
• If your VPN does not support IPv6, make sure IPv6 traffic is blocked or tunneled, not sent around the VPN.
• Turn off split tunneling for the apps you want to protect.
• Check again after changes: run a DNS leak test with the VPN on and compare the resolvers with your provider.

Why sites care

For anti-fraud systems, the resolver is one more location signal. A connection from a VPN in one country with DNS resolvers of a provider in another fits the picture of someone hiding their location. Like other signals, it is a hint, not proof.

Does SpoofLens test DNS leaks?

Not yet: it needs a dedicated name server that logs lookups, which is planned for a later version. Today SpoofLens shows the other half of the picture: your IP network, whether it belongs to a VPN or data center, your time zone against the IP country and WebRTC. BrowserLeaks offers a DNS leak test if you need one now.

Frequently asked questions

Is a DNS leak dangerous?

It exposes the sites you look up to your internet provider and reveals your real location to the sites you visit. Your traffic itself still goes through the VPN.

Does private browsing prevent DNS leaks?

No. Private or incognito mode only stops the browser from keeping history and cookies on your device.

Does encrypted DNS replace a VPN?

No. It hides lookups from your provider but not your IP address or traffic from the sites you visit.

Read next

• Browser fingerprinting: what it is and how it works
• How websites detect bots and automated browsers
• Canvas, WebGL and audio fingerprints: how they work
• WebRTC leak: what it is and how to check your browser
• Time zone vs IP: why websites notice your VPN
• How websites recognise antidetect browsers