What a DNS Leak Exposes
DNS translates domain names into addresses that applications can connect to. If queries leave an intended VPN route, the resolver or a network observer may learn requested names. HTTPS can still protect page content; a DNS leak does not undo that encryption.
How DNS Resolution Works
Applications usually ask a recursive resolver to look up a name. That resolver may answer from cache, forward the request, or contact authoritative DNS servers. Browser encrypted-DNS settings can select a different resolver from the one used by the operating system.
Domain Names Are Sensitive Metadata
Requested names can suggest interests or services in use, even when page contents stay encrypted. They do not establish which person used a device, which page they read, or why a query occurred. Background requests, prefetching, and caching prevent a one-to-one mapping between DNS queries and browsing history.
Use Zunavek's DNS Leak Test to observe resolvers handling generated test queries, then compare them with your expected configuration.
How DNS Can Take an Unexpected Route
VPN routing, split tunneling, per-interface DNS settings, and browser resolver choices can interact. A VPN connection indicator alone does not show which path a particular query takes.
Windows Multi-Homed Name Resolution
Windows has policies for optimizing name resolution across networks. Behavior depends on version, policy, interface settings, and the VPN client. Administrators can review Microsoft's DNS client policy documentation when investigating a configuration.
IPv4 and IPv6 Coverage
A VPN must account for both address families available on the device. Some clients tunnel IPv6; others block it. If IPv6 remains available outside an IPv4-only tunnel, some traffic may use that route. Check the client's documented behavior for both families. HTTPS still encrypts content on a direct IPv6 connection.
Unencrypted DNS and Interception
Setting a public resolver address does not encrypt DNS. Networks can observe or redirect unencrypted port-53 traffic. Authenticated encrypted DNS protects the connection to the selected resolver, but that resolver still receives the queries.
Split Tunneling
Split tunneling deliberately sends some traffic outside a VPN. Check whether your browser, DNS resolver, and relevant address families are included in the tunnel. A direct resolver can be intentional; assess it against the route you configured.
Testing DNS Routing
How a Browser DNS Test Works
- The page generates unique names under a domain controlled by the test service.
- Your browser requests those names, causing DNS lookups.
- The service observes the resolver addresses reaching its authoritative DNS server.
- You compare those observations with your browser, operating-system, and VPN settings.
The observed address may belong to a forwarding or upstream resolver. Provider names and locations do not establish whether the client-to-resolver connection crossed a VPN or used encryption. A resolver outside the VPN provider's network is not automatically a leak.
Short and Repeated Tests
Repeated query rounds can reveal resolver changes during the test. Test names and durations vary by service; an extended test is more sampling, not a guarantee. Browser tests cover their generated queries rather than every application on your device.
The simulation below illustrates the query and observation steps:
Simulation only: addresses are reserved for documentation. A resolver match does not prove VPN routing or encryption; compare real results with your VPN and browser DNS settings. To check your connection, use our live DNS Leak Test.
Known public DNS resolver addresses
These documented IPv4 and IPv6 addresses belong to public DNS services. Anycast services use the same address at multiple sites, so an IP database location does not identify every resolver site.
Review Settings on Your Platform
Start with the VPN provider's instructions for your operating system. Changing a resolver address alone does not force queries into a tunnel, and manual overrides can interfere with managed or corporate DNS.
Windows
Confirm the VPN's DNS and IPv6 coverage, split-tunnel settings, and kill-switch scope. Review active adapter settings and any organizational DNS policies. Use the provider's supported configuration before changing advanced Windows policies or disabling protocols.
macOS
Review the VPN profile and the DNS servers associated with each network service. Apple documents manual DNS settings in Change DNS settings on Mac. A manually entered resolver is not proof of tunnel coverage. Repeat observations after switching networks.
Android
Check how your VPN interacts with Android's Private DNS setting and whether always-on VPN or blocking connections without a VPN is supported on your device. Follow Android's VPN instructions. Changing cellular APN protocols is not a general DNS-leak fix and can disrupt service.
iOS
Wi-Fi DNS settings, encrypted-DNS profiles, VPN configurations, and iCloud Private Relay have different scopes. Check the feature you use and test on both Wi-Fi and cellular. Private Relay covers specific traffic; it is not a general replacement for a device VPN.
Linux
Configure DNS through the network manager and resolver actually used by your distribution. On systems using systemd-resolved, resolvectl status helps inspect per-link DNS servers and routing domains. Consult the systemd-resolved documentation. Keep DNS settings managed through those supported tools so VPN and network changes can update them.
Encrypted DNS: DoH, DoT, and DoQ
DNS encryption protects query contents between a client and resolver. VPN routing answers a different question: which network path carries that connection? Check both when deciding what a local network can observe.
DNS-over-HTTPS
DoH carries DNS over HTTPS, commonly on port 443. The resolver receives your queries, and networks can block known endpoints. Browser fallback behavior varies, so inspect whether your chosen mode requires encrypted DNS or can fall back.
DNS-over-TLS
DoT carries DNS over TLS, normally on TCP port 853. A dedicated port makes the service easy to identify or block. What happens after a failure depends on client policy; a blocked connection does not necessarily trigger unencrypted fallback.
DNS-over-QUIC
DoQ uses encrypted QUIC connections, normally on UDP port 853. Independent streams avoid TCP head-of-line blocking between queries. Optional 0-RTT data applies to resumed connections, with protocol restrictions. New connections still require a handshake.
Encrypted DNS Protocol Comparison
| Feature | ||||
|---|---|---|---|---|
| DNS-over-HTTPS (DoH) | 443 | Carries DNS queries over HTTPS | Uses HTTPS infrastructure; encrypts queries in transit | Resolver still sees queries; known endpoints can be blocked |
| DNS-over-TLS (DoT) | 853 | Dedicated TLS tunnel for DNS queries only | Clean protocol separation; easier for admins to audit and monitor | Easy to block - censors simply shut down port 853 |
| DNS-over-QUIC (DoQ) | UDP 853 (default) | QUIC transport layer (UDP-based, encrypted) | Independent streams reduce head-of-line blocking | Requires client and resolver support |
Common DNS Privacy Misconceptions
Private Browsing
Private browsing limits retained browser history and session data. It does not itself add DNS encryption or establish VPN routing. DNS follows the browser and system configuration already in effect.
Kill Switch Coverage
Kill switches differ in what they block and when they activate. Read the VPN's documentation and test disconnects and network transitions. A feature name alone does not establish coverage for every route.
Provider Pricing and Trust
A free or paid plan does not establish a provider's logging practices or routing behavior. Review its policies, business model, technical documentation, and any published audit scope.
DNS Routing Checklist
DNS Leak Prevention Checklist
| Feature | ||
|---|---|---|
| Enable VPN Kill Switch | Can block traffic during disconnects; check app coverage | Low |
| Check VPN IPv6 Coverage | Verify IPv6 is tunneled or blocked by the VPN | Low |
| Run Regular DNS Leak Tests | Observes test queries under the conditions tested | Low |
| Review DNS Routing | Confirm queries follow the intended VPN or encrypted-DNS route | Medium |
| Enable DoH in Browser | Encrypts supported browser queries to the selected resolver | Medium |
A Repeatable Check
- Record direct-connection public addresses and resolver observations.
- Connect the VPN and confirm its documented IPv4, IPv6, and DNS settings.
- Repeat the DNS test and compare with the expected resolver configuration.
- Retest after reconnecting, switching networks, or changing browser DNS settings.
Latency is not evidence of a DNS leak. Resolver ownership and approximate location are useful context, but do not prove which route a query took.
What Audits Can Establish
An independent audit can provide evidence about the systems and period it examined. Read its scope, findings, and limitations. It does not prove that a provider never logs data or that your current device is configured correctly.
Check the Configuration You Use
Encrypted-DNS defaults and VPN integrations vary across products and releases. Recheck after relevant updates. A successful browser test records an observation under those conditions; it does not certify future privacy.
Frequently Asked Questions
What is a DNS leak?
A DNS leak occurs when DNS queries use a route outside the VPN or resolver configuration you intended. Unencrypted queries on the local network can expose requested domain names. A query is not a complete record of page visits: caching and background requests affect what appears.
Does a VPN automatically prevent DNS leaks?
Not always. Coverage depends on the VPN app, operating system, IPv4 and IPv6 routing, split tunneling, and browser DNS settings. Compare observed resolvers with the configuration your provider documents.
Can my ISP see what websites I visit if I use DNS-over-HTTPS?
When a query uses authenticated DoH, its contents are encrypted between the client and resolver. The resolver still receives the query. The ISP may infer destinations from connection addresses or other visible metadata; queries outside DoH are not covered.
Does incognito mode prevent DNS leaks?
Private browsing does not by itself change your DNS routing or add DNS encryption. Queries still follow the browser, operating system, and VPN settings in effect, which may already use encrypted DNS.
How often should I test for DNS leaks?
Retest after VPN, browser, operating-system, or network configuration changes. If reliable VPN coverage matters, also check reconnection and Wi-Fi-to-cellular transitions. Repeat tests can reveal changes but do not certify all traffic.
What is the difference between a standard and extended DNS leak test?
Names and durations vary by tool. More query rounds provide more observations and may reveal intermittent resolver changes. Neither a short nor an extended browser test proves that every application or future connection uses the intended DNS route.