DNS Hijacking vs DNS Leaks: What's Different?

The word DNS appears in two very different worries. One is a DNS leak, where your lookups travel outside your VPN to a resolver you did not choose. The other is DNS hijacking, where somebody changes the answer so that a name you type leads to the wrong place. People often mix them up, partly because the same test pages and the same kind of tools get used for both, and partly because both involve the same service. They are different problems with different causes, different symptoms and different fixes.

This article compares them directly. It assumes you know that DNS converts names to addresses (see how DNS works if not) and it does not repeat the full explanation of leaks, which lives in what a DNS leak is. Here the aim is to help you decide which problem you actually have, and what a VPN does and does not do about it.

Visibility versus integrity

A good way to hold the difference in your head is to use two words from security: visibility and integrity.

• A leak is a visibility problem. The answers you get are correct. The problem is that someone you did not choose can read the questions. If your VPN is on but a lookup for a site goes to your mobile operator's resolver, the operator learns that you asked about that site. The page still loads, and still loads the right content.
• Hijacking is an integrity problem. The questions might be seen by nobody extra, but the answer is false. You type your bank's name and get the address of a copy. The page might look right, but it is not the real thing. Visibility has nothing to do with it.

You can have either one without the other, or both at once. A café network that intercepts lookups both sees them (visibility) and may replace the answers (integrity). A home router that has been quietly reconfigured to use a malicious resolver is a hijack even if you are not on a VPN at all.

Side by side

Feature	DNS leak	DNS hijacking
What is affected	Who sees your lookups	What answer you receive
Are the answers correct?	Yes	No, they are altered
Typical harm	Loss of privacy, browsing history visible to the resolver's owner	Fake sites, stolen logins, unwanted ads, malware downloads
Typical cause	VPN or system sends queries to the wrong resolver	Compromised router, malicious or rogue resolver, malware, tampering on the network path
How you notice	A leak-test page shows a resolver you did not choose	Redirects, strange search pages, certificate warnings, wrong-looking sites
First fix	Correct the VPN or DNS settings, test again	Remove the cause, reset router and credentials, scan devices
Does a VPN help?	Yes, that is its job when it works correctly	Partly, against tampering on the local network

The table hides one nuance: a leak can enable a hijack. If your lookups slip out to a resolver on a hostile network, that network can answer them falsely. Leaks matter because they widen the set of parties who can see or alter your traffic.

How hijacking actually happens

Hijacking is not one technique. It is a family of ways to put a false answer in front of you. The main ones for ordinary users are these.

1. A changed setting on your router. Home routers often keep a default or weak admin password. If someone gets in, they can swap the DNS servers the router hands to every device in the house. Everything on the network then asks a resolver the attacker controls.
2. Malware on a device. Software on your computer or phone can change its DNS settings, edit the hosts file or install a rogue proxy. The device then sends names to the wrong place regardless of the network.
3. A rogue network. A malicious access point or a compromised public hotspot can answer lookups itself, or hand out its own resolver when your device joins.
4. Interception on the path. Plain DNS is not encrypted. Anyone sitting between you and the resolver, and some networks do this for convenience or filtering, can reply with their own answer before the real one arrives.
5. A tampered resolver cache. Cache poisoning inserts a false record into a shared resolver. Modern resolvers defend against most known tricks, and this is rarer for ordinary users, but it has happened.
6. A hijacked domain. An attacker can take over the account at the registrar or DNS host and change where a real name points. In that case your own device and network did nothing wrong. This one is for the site owner to prevent.
7. Resolver behaviour you did not agree to. Some internet providers answer "this name does not exist" with a search or advertising page. That is not theft, but it is a change to the answer that you did not ask for.

Most of these are defensive subjects for the user: you want to know what to look for, not how to do it.

Signs that something is hijacking your lookups

Signs of leaks and hijacks overlap only a little. Typical hijack signs are:

• A well-known website suddenly shows a browser certificate warning that the connection is not private.
• A page you have used a hundred times looks slightly wrong: different layout, odd language, extra login prompts.
• Typing a site name in the address bar brings up a search or advertising page you do not recognise instead of "site not found".
• Several devices at home show the same strange behaviour, which suggests the router, not one device.
• Your router's DNS setting lists servers you did not choose.
• Software update or security pages fail to open, or antivirus sites are blocked, which some malware does.

Typical leak signs are quieter: a test page shows an unexpected resolver, or your DNS test result changes between the VPN being on and off. The page always works normally. If you only see the second kind of sign, you are probably dealing with a leak rather than a hijack.

A step-by-step check you can do now

Work from the simplest check outward.

1. Look at your router. Open its admin page, usually on a private address printed on the device label, and find the DNS or internet settings. Note which DNS servers are listed. If they say automatic, your provider's servers are used. If they are manual, make sure you recognise them.
2. Check the device. Open your network settings and see whether DNS has been set by hand. On a computer, also check for an unexpected proxy setting in the system or browser.
3. Compare answers. Look up the same well-known name on two different resolvers, for example with the nslookup tool by naming a resolver after the site, and see whether the addresses agree. Large sites with many addresses may differ slightly, so look for results that are completely different or point to unfamiliar networks, not for small variations.
4. Try another network. Switch from home Wi-Fi to mobile data. If the strange behaviour disappears, the cause is on the first network or router, not on your device.
5. Try a clean browser profile. If an extension or a setting in one browser is the cause, a fresh profile will behave normally.
6. Inspect the certificate. On a suspicious page, click the padlock and read the certificate details. A real site presents a valid certificate for its own name. A mismatch means stop.
7. Run a leak test separately. If everything above is clean, a leak test tells you whether the other problem, visibility, is present.

If a device behaves strangely on any network, treat it as a device problem and scan it with a trusted security tool before doing anything else.

What a VPN does about each problem

A VPN is not a cure for both, and it is worth being exact about what it covers.

Against leaks: a properly working VPN sends lookups through the tunnel to its own resolver, so the local network and your mobile operator no longer see them. The VPN's operator sees them instead, which is a trust choice you should make knowingly. Testing for leaks, as in how to check if your VPN is working, tells you whether it is actually working that way on your device.

Against local hijacking: because the lookups travel inside the encrypted tunnel, a hotel router, a rogue hotspot or an interfering network cannot read or replace them on the way. That is a real benefit on shared Wi-Fi, and one reason people use a VPN there. Staying safer on public Wi-Fi covers the wider picture.

What it does not do:

• It does not repair a compromised home router. If the router has been changed, the VPN may still work on top of it, but the settings your other devices use remain wrong.
• It does not remove malware that edits DNS settings on the device itself.
• It does not prove that the resolver at the other end is honest. You are moving trust, not removing it.
• It does not stop a hijacked domain at the registrar.
• It does not tell you whether a page is real. Phishing sites reached through correct DNS are still phishing sites. Recognising phishing websites is a separate skill.

Other defences that work with a VPN

Several tools address integrity directly, and they combine well with a VPN.

• HTTPS and certificates. The browser checks that the site you reach can prove it owns the name. If the DNS answer sends you to a copy, the certificate does not match and you get a warning. See what HTTPS provides in Cloudflare's explanation, and never click through warnings on familiar sites.
• Encrypted DNS. DNS over HTTPS (RFC 8484) and DNS over TLS encrypt the question and answer between you and a resolver, which stops simple on-path tampering. The comparison with tunnels is in DNS over HTTPS vs VPN.
• DNS signing. DNSSEC lets a domain owner sign records so that validating resolvers can detect forged answers. It protects the data, not the privacy of your questions, and only helps if both the domain and the resolver support it.
• Router hygiene. A strong unique admin password, current firmware and remote administration switched off remove the easiest path for a router hijack.
• Two-factor authentication. If you land on a fake page and type your password, a second factor still protects the account.

Three scenarios

The café with a strange login page. Lena joins a café network, opens her bank's website and sees a certificate warning. She does not proceed. She switches to mobile data and the site loads normally. The café network was altering or intercepting lookups. She reports it to the staff and avoids using that network for anything sensitive.

The family laptop and the odd search page. At home, three devices begin showing an unfamiliar search page when someone mistypes an address. Different devices, same symptoms, so the router is the suspect. Her father opens the router's admin page and finds two unknown DNS servers. He restores the provider settings, changes the admin password, updates the firmware and checks each device. A VPN on one laptop would have covered that laptop only; the router fix covers everybody.

The leak that was only a leak. Kai uses a VPN on his phone and runs a test page. It lists his mobile operator's resolver. Pages load correctly and nothing looks odd. This is a leak, not a hijack: the answers are right, but the questions are visible to an operator he did not intend. He fixes the settings in the VPN and phone, tests again and finds only the VPN's resolver listed.

If you think you have been hijacked

1. Stop entering passwords or card details on that connection.
2. Move to a different network, such as mobile data, and check your important accounts from there.
3. Change the passwords of accounts you used while the problem was present, starting with email and banking, and turn on two-factor authentication.
4. Reset the router DNS settings, change the router admin password and update its firmware.
5. Run a scan on every device, and remove unknown browser extensions and proxy settings.
6. Tell your bank or any service where you suspect a login was exposed.
7. Report fake pages to the organisation they imitate; CISA's guidance on phishing explains how to report them.

Summary

A DNS leak lets the wrong party see your questions; DNS hijacking gives you a false answer. A leak is a privacy problem fixed by correct VPN and DNS settings. A hijack is an integrity problem fixed by removing its cause, whether a router, malware or a hostile network. A working VPN helps against both on untrusted networks, but it cannot repair a compromised router or judge whether a site is genuine. Keep HTTPS warnings, router hygiene and two-factor authentication in your toolkit alongside it.

For help with the VPN side of this, the download page links to the free VPNclient app, and the check-up guide above shows how to test it.