What a DNS Leak Is
When you type a website address into your browser, a DNS (Domain Name System) server translates that address into an IP address. Normally, your browser sends DNS requests to your ISP's DNS servers. When you use a VPN, those requests should go through the VPN tunnel to the VPN's DNS servers. Your ISP should not be able to see which websites you are visiting.
A DNS leak happens when some or all DNS requests bypass the VPN tunnel and go directly to your ISP's servers. This means your ISP can see which domains you are looking up even though you think you are protected by a VPN.
How to Test for DNS Leaks
Connect to your VPN and navigate to dnsleaktest.com or ipleak.net. These tools show which DNS servers are resolving your requests. The results should show your VPN provider's DNS servers, not your ISP's. If you see your ISP listed in the DNS results, you have a DNS leak.
Run the extended test on dnsleaktest.com, which makes multiple DNS requests to catch intermittent leaks that the standard test might miss. A single-request test can miss leaks that only occur on some requests.
Common Causes of DNS Leaks
IPv6 is the most common cause. Many VPN clients route IPv4 traffic through the tunnel but leave IPv6 traffic unprotected. Your ISP's IPv6 DNS servers then handle your DNS requests. Good VPNs either disable IPv6 or tunnel it correctly. Check your VPN's settings for an IPv6 kill switch or IPv6 leak protection option.
Windows Teredo is another common cause on Windows machines. Teredo is a Microsoft tunneling protocol for IPv6 that can bypass VPN tunnels. Disable it via the command prompt: run netsh interface teredo set state disabled.
Split tunneling misconfiguration can route DNS requests outside the VPN even when you intended all traffic to go through. If you use split tunneling, verify that DNS requests are explicitly included in the VPN tunnel.
Fixing DNS Leaks
Use a VPN client with built-in DNS leak protection. Mullvad, ExpressVPN, and ProtonVPN all have reliable DNS leak protection. Configure your operating system's DNS settings to point to your VPN's DNS servers rather than auto-detect. On Windows, go to Network Settings, then your adapter's IPv4 and IPv6 properties, and manually enter your VPN's DNS server addresses.