---
title: "What Is a DNS Leak? How to Test and Fix It | vpnrank.io"
description: "A DNS leak happens when your DNS queries bypass the VPN tunnel and go to your ISP, exposing the websites you visit even with a VPN on. How DNS leaks happen, how to test for one, and how a good VPN prevents them."
url: https://vpnrank.io/glossary/dns-leak
language: en
---

[VPN Glossary](https://vpnrank.io/glossary)

# What Is DNS Leak?

A DNS leak is a flaw where your device's DNS queries — the lookups that translate website names like example.com into IP addresses — travel outside the encrypted VPN tunnel to your ISP's DNS servers instead of the VPN's. The result: even with the VPN connected and your IP address hidden, your ISP (or anyone watching) can still see every website you request, defeating much of the VPN's privacy benefit.

## Why DNS leaks happen

Every website visit starts with a DNS lookup. A properly working VPN routes these lookups through its own encrypted DNS resolvers inside the tunnel. A DNS leak occurs when, through a configuration flaw or OS behavior, those lookups instead go to the DNS server your device used before the VPN connected — usually your ISP's.

Common causes: operating systems (especially Windows) that send DNS queries to multiple resolvers at once for speed, IPv6 traffic leaking when a VPN only routes IPv4, manually configured DNS settings that override the VPN, and 'Smart Multi-Homed Name Resolution' on Windows. Transparent DNS proxying by some ISPs can also force leaks.

## How to test for a DNS leak

Connect your VPN, then visit a DNS-leak test site (most VPN providers host one). Run the extended test. If the DNS servers shown belong to your VPN provider or its DNS partner, you're protected. If any belong to your ISP or are located in your real country, you have a leak.

Test after reconnecting, after switching networks, and after waking from sleep — leaks often appear only in these transition moments rather than during a steady connection.

## How a good VPN prevents DNS leaks

Quality VPNs run their own DNS resolvers and force all queries through the tunnel, include full IPv6 leak protection (or block IPv6 entirely), and pair DNS protection with a [kill switch](https://vpnrank.io/glossary/kill-switch) so that if the tunnel drops, no queries escape. [ExpressVPN](https://vpnrank.io/reviews/expressvpn), NordVPN, and Surfshark all passed our DNS, IPv6, and WebRTC leak tests across platforms.

If you find a leak: enable your VPN's built-in leak protection and kill switch, disable IPv6 at the OS level if the VPN doesn't handle it, and switch to the VPN's own DNS rather than a custom one. If leaks persist across servers, the provider's leak protection is inadequate — switch providers.

## Frequently Asked Questions

Does a DNS leak reveal my browsing history?

It reveals the domains you look up — effectively the websites you visit — to whichever DNS server received the query, typically your ISP. It doesn't expose the full page contents (those are still encrypted by HTTPS), but the list of sites is exactly what most people use a VPN to hide, so a DNS leak undermines the core privacy purpose.

How do I know if my VPN has a DNS leak?

Connect the VPN and run an extended test at a DNS-leak test site. If the listed DNS servers belong to your VPN provider, you're fine; if any belong to your ISP or sit in your real country, you have a leak. Re-test after reconnecting and after switching networks, since leaks often appear only at those moments.

Which VPNs prevent DNS leaks?

Providers that run their own DNS, force queries through the tunnel, and include IPv6 leak protection plus a kill switch. ExpressVPN, NordVPN, and Surfshark all passed our DNS, IPv6, and WebRTC leak tests. Many free and low-quality VPNs fail these tests.

Can a kill switch stop DNS leaks?

A kill switch stops leaks that happen when the tunnel drops, by blocking all traffic until it reconnects. But DNS can leak even while the tunnel is up if the VPN doesn't force DNS through it — so a kill switch is necessary but not sufficient. You need both proper DNS handling and a kill switch.

## Related Terms

[VPN](https://vpnrank.io/glossary/vpn) [VPN Kill Switch](https://vpnrank.io/glossary/kill-switch) [No-Logs Policy](https://vpnrank.io/glossary/no-logs-policy)

## Related Guides

[Best VPN for Privacy](https://vpnrank.io/best-vpn/vpn-privacy) [How We Test VPNs](https://vpnrank.io/how-we-test) [Dangers of Free VPNs](https://vpnrank.io/best-vpn/free-vpn/dangers-of-free-vpns)

Structured data (JSON-LD):

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://vpnrank.io/#organization","name":"VPNRank","alternateName":"vpnrank.io","url":"https://vpnrank.io","email":"hello@vpnrank.io","logo":{"@type":"ImageObject","url":"https://vpnrank.io/logos/favicon.png","width":500,"height":500},"description":"Independent VPN comparison. We track 9 major VPN services every day and rank them for privacy, security, speed and value.","foundingDate":"2026-03","sameAs":["https://www.youtube.com/@vpnrank","https://www.instagram.com/vpnrank.io","https://www.facebook.com/people/VPNRankio/61592338017872/"],"knowsAbout":["Virtual Private Networks","Internet Privacy","Cybersecurity","Network Encryption","VPN Protocols"]}
```

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://vpnrank.io/#editorial-team","name":"VPNRank Editorial Team","url":"https://vpnrank.io/about","parentOrganization":{"@id":"https://vpnrank.io/#organization"},"description":"A team of privacy and cybersecurity analysts who independently test VPN services for speed, security, leak protection, and value.","knowsAbout":["VPN testing methodology","WireGuard and OpenVPN protocols","DNS and IPv6 leak testing","No-logs policy audits","Encryption standards"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","@id":"https://vpnrank.io/#website","name":"VPNRank","alternateName":"vpnrank.io","url":"https://vpnrank.io","publisher":{"@id":"https://vpnrank.io/#organization"},"inLanguage":"en-US"}
```

```json
{"@context":"https://schema.org","@type":"DefinedTerm","name":"DNS Leak","description":"A DNS leak is a flaw where your device's DNS queries — the lookups that translate website names like example.com into IP addresses — travel outside the encrypted VPN tunnel to your ISP's DNS servers instead of the VPN's. The result: even with the VPN connected and your IP address hidden, your ISP (or anyone watching) can still see every website you request, defeating much of the VPN's privacy benefit.","url":"https://vpnrank.io/glossary/dns-leak","inDefinedTermSet":{"@type":"DefinedTermSet","name":"VPNRank VPN Glossary","url":"https://vpnrank.io/glossary"}}
```

```json
{"@context":"https://schema.org","@type":"Article","headline":"What Is a DNS Leak? How to Test and Fix It","description":"A DNS leak happens when your DNS queries bypass the VPN tunnel and go to your ISP, exposing the websites you visit even with a VPN on. How DNS leaks happen, how to test for one, and how a good VPN prevents them.","url":"https://vpnrank.io/glossary/dns-leak","image":"https://vpnrank.io/opengraph-image","mainEntityOfPage":{"@type":"WebPage","@id":"https://vpnrank.io/glossary/dns-leak"},"datePublished":"2026-06-13","dateModified":"2026-06-13","author":{"@id":"https://vpnrank.io/#editorial-team"},"publisher":{"@id":"https://vpnrank.io/#organization"},"inLanguage":"en-US"}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://vpnrank.io"},{"@type":"ListItem","position":2,"name":"VPN Glossary","item":"https://vpnrank.io/glossary"},{"@type":"ListItem","position":3,"name":"DNS Leak","item":"https://vpnrank.io/glossary/dns-leak"}]}
```

```json
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does a DNS leak reveal my browsing history?","acceptedAnswer":{"@type":"Answer","text":"It reveals the domains you look up — effectively the websites you visit — to whichever DNS server received the query, typically your ISP. It doesn't expose the full page contents (those are still encrypted by HTTPS), but the list of sites is exactly what most people use a VPN to hide, so a DNS leak undermines the core privacy purpose."}},{"@type":"Question","name":"How do I know if my VPN has a DNS leak?","acceptedAnswer":{"@type":"Answer","text":"Connect the VPN and run an extended test at a DNS-leak test site. If the listed DNS servers belong to your VPN provider, you're fine; if any belong to your ISP or sit in your real country, you have a leak. Re-test after reconnecting and after switching networks, since leaks often appear only at those moments."}},{"@type":"Question","name":"Which VPNs prevent DNS leaks?","acceptedAnswer":{"@type":"Answer","text":"Providers that run their own DNS, force queries through the tunnel, and include IPv6 leak protection plus a kill switch. ExpressVPN, NordVPN, and Surfshark all passed our DNS, IPv6, and WebRTC leak tests. Many free and low-quality VPNs fail these tests."}},{"@type":"Question","name":"Can a kill switch stop DNS leaks?","acceptedAnswer":{"@type":"Answer","text":"A kill switch stops leaks that happen when the tunnel drops, by blocking all traffic until it reconnects. But DNS can leak even while the tunnel is up if the VPN doesn't force DNS through it — so a kill switch is necessary but not sufficient. You need both proper DNS handling and a kill switch."}}]}
```