What Is a DNS Leak?

Every time you type a website name, your device first has to find out which address belongs to it. That lookup is called a DNS query. When you use a VPN, those queries should travel through the encrypted tunnel with the rest of your traffic. A DNS leak is when they do not: the lookups go out the normal way, and whoever runs that path can see which sites you are asking about.

A quick refresher on DNS

DNS, the Domain Name System, works like a phone book for the internet. Computers connect using numeric addresses, but people use names such as example.com. When you open a name, your device asks a DNS server to translate it into an address. The system is described in RFC 1034 and RFC 1035, and the how DNS works article walks through the steps in plain language.

By default, your device uses the DNS server given to it by the network, which is usually run by your internet provider or the network owner. Traditional DNS queries are not encrypted, so anyone on the path can read them.

What a DNS leak looks like

Here are two situations side by side.

	Without a leak	With a leak
Web traffic	Goes through the VPN tunnel	Goes through the VPN tunnel
DNS queries	Go through the tunnel to a DNS server chosen by the VPN	Go outside the tunnel to your internet provider's or network's DNS server
What your internet provider sees	An encrypted connection to the VPN server	The same, plus a list of the site names you look up

The page content is still protected inside the tunnel, so a DNS leak does not hand over your passwords or messages. What leaks is metadata: a record that this connection looked up examplebank.com and examplenews.com at these times. For many people that is exactly the information they hoped the VPN would shield.

A concrete example

Mia is in a hotel and connects to a VPN. She opens a travel forum. Her browser first asks, "What is the address of this forum?" If that question goes through the VPN tunnel, the hotel network sees nothing but encrypted traffic. If the question leaks out and goes to the hotel's DNS server, the hotel network can log that Mia looked up that forum, even though the pages themselves loaded through the VPN.

Why DNS leaks happen

• The operating system uses more than one DNS server. Some systems send queries to several servers at once or to the fastest one that answers, which can include a server outside the tunnel.
• Custom DNS settings. If you or an app configured a fixed DNS server on the device or router, the VPN may not override it.
• Network changes. Switching between Wi-Fi and mobile data can reset which DNS servers are used.
• IPv6 handling. If the VPN only handles IPv4 (RFC 8200 describes IPv6) and the network offers IPv6, some queries may bypass the tunnel.
• Browser-level DNS. Some browsers can use encrypted DNS over HTTPS (RFC 8484) with their own chosen server. That can protect the query from the local network, but it also means the lookup does not follow the VPN's DNS setup.
• Apps excluded from the tunnel. If you set some apps to bypass the VPN, their lookups follow.
• Unstable connections. If the VPN drops and reconnects, queries can go out in the gap.

A leak is usually a configuration problem rather than someone attacking you. That is good news, because configuration is fixable.

How to test for a DNS leak

1. Disconnect the VPN and run a DNS leak test from any reputable testing site. Note which DNS servers appear. These are your normal ones, usually belonging to your internet provider or router.
2. Connect the VPN and wait for it to show as connected.
3. Run the test again. The servers listed should now differ from the first run, and should not belong to your normal internet provider.
4. Repeat on any other network you regularly use, such as mobile data.
5. Repeat after switching apps or browsers, because browsers can behave differently.

If the results after connecting still show your provider's DNS servers, you probably have a leak. The help guide on checking whether your VPN is working includes this test among others. A related issue, WebRTC leaks, can expose your real IP address through the browser and is tested separately.

How to fix a DNS leak

Work through these in order and test again after each change.

1. Reconnect the VPN. Disconnect, wait a few seconds, connect again, and re-run the test.
2. Update the app and the operating system. Many leaks are fixed in updates.
3. Check for excluded apps. If you have apps set to bypass the VPN, remove the exclusion or test without them.
4. Review custom DNS settings. If your device or router has a manually set DNS server, set it back to automatic so the VPN can supply its own.
5. Check your browser's DNS setting. If you turned on a browser's own secure DNS option, try turning it off for the test and compare.
6. Switch networks and retest. Try mobile data to see whether the issue is tied to one Wi-Fi network.
7. Try another connection method if the app lets you choose one. The My Pass page of your account lists the supported methods.
8. Contact support. If the leak persists, tell your provider what the test showed.

Do not turn off security features, such as a firewall, just to make a test pass.

Limits and what to watch for

• A clean test result on one day and one network is a snapshot, not a guarantee. Retest after changes such as an operating system update, a new router or a different network.
• Test websites differ, and some are better than others. Use more than one if you are not sure of a result.
• Fixing a DNS leak does not make you anonymous. Cookies, accounts and fingerprints still identify you; see can a VPN make you anonymous for that wider picture.
• Some VPN tools offer a kill switch, which blocks traffic when the VPN drops. If your app has one, it can prevent leaks during reconnections.
• Network-level DNS filtering at work or school is a separate setup. Do not try to change settings on a managed device without permission.

Summary

A DNS leak means your website lookups go outside the VPN tunnel, so your internet provider or local network can see which sites you visit even though the page content is protected. Causes are mostly configuration: multiple DNS servers, custom settings, IPv6, browser DNS, excluded apps or unstable connections. Test with and without the VPN, fix settings one step at a time, and retest whenever your setup changes.

If you want to check your own connection, the Help Center has step-by-step guides, and a prepaid XPASS pass gives you a fixed period to try it with no automatic renewal.