Tips / DNS Leaks Explained
DNS Leaks Explained
You can have your VPN connected, your kill switch on, and still quietly leak which sites you visit. The culprit is usually a DNS leak. Because the system that translates website names into addresses can bypass your tunnel, your provider may still see your destinations. Here is how leaks happen and how to stop them.
What a DNS lookup is
Every time you visit a site, your device asks a DNS server to translate the human-friendly name into a numeric address. If that question is sent outside your VPN tunnel — to your provider's default server — then your provider learns every site you visit, even though the rest of your traffic is encrypted.
Why leaks happen
Leaks often come from the operating system insisting on using its own DNS settings, from IPv6 traffic slipping around an IPv4-only tunnel, or from a poorly configured VPN app. The result is the same: a quiet side channel that undermines the privacy you thought you had.
How to test for a leak
Connect your VPN, then visit a DNS leak test website. It will show which DNS servers are answering your queries. If you see your own internet provider listed instead of your VPN's servers, you have a leak that needs fixing.
How to stop leaks
Enable DNS leak protection in your VPN app — most quality providers offer it. Turn on IPv6 leak protection too, or disable IPv6 if your app cannot tunnel it. Make sure the app routes DNS through its own encrypted servers rather than the system default, and re-test until the leak test shows only the VPN's servers.
Belt and braces
For extra assurance, combine DNS leak protection with the kill switch and a provider that runs its own private DNS. This layered approach means even an unusual network configuration cannot quietly expose your activity.