Fixing DNS leaks on Android
On Android the usual cause is Private DNS, which sends every lookup to a resolver you named over TLS regardless of what the VPN configured. The lookups are encrypted, so nobody on the network reads them, but they do not go where the tunnel intended. Set it to Automatic while connected.
4 min read
Android leaks DNS less often than Windows does, and when it happens the cause is usually a setting the user turned on deliberately for privacy reasons. That is what makes it confusing: the leak test reports a resolver you have never heard of, on a device you configured carefully.
Confirm what you are seeing
Run the DNS leak test with the tunnel up. Note who operates the resolvers that answer. There are three meaningfully different results:
- Your mobile carrier or home ISP. A real leak. Lookups are leaving in the clear and your provider has the list.
- A large public resolver you did not configure. Almost certainly Private DNS or a browser doing its own thing. Encrypted, but not where the tunnel intended.
- The resolver the tunnel configures. No leak.
Cause one: Private DNS
Settings, Network & internet, Private DNS. When set to a hostname, Android sends every lookup to that resolver over TLS, system-wide, and this takes precedence over the resolver a VPN sets.
That is deliberate design. Private DNS is a system-level privacy feature and it is not supposed to be overridable by an app. The consequence behind a VPN is that your traffic exits at the VPN server while your lookups go to a third party directly.
Set it to Automatic while using a VPN. Automatic uses the resolver the active network provides, which is the tunnel's when one is up.
Cause two: the browser
Chrome and Firefox on Android can use DNS-over-HTTPS to their own resolver, separately from Android's Private DNS and separately from the VPN.
Chrome: Settings, Privacy and security, Use secure DNS. Firefox: Settings, Privacy and security, DNS over HTTPS. Turning both off makes the browser follow the system, which follows the tunnel.
Cause three: a second VPN or a DNS-filtering app
Android allows exactly one active VpnService at a time. Ad-blockers,
parental-control apps and "private DNS" apps frequently implement themselves as
a local VPN in order to intercept traffic, which means installing one silently
displaces your actual VPN.
Settings, Network & internet, VPN lists everything with a configuration. If something other than your VPN client is there and connected, that is the whole explanation.
Cause four: a genuine leak on a split tunnel
If your client uses per-app routing and the app doing the lookup is outside the tunnel, its DNS goes outside too. That is correct behaviour for the configuration and a leak from the user's point of view.
Check which model your client uses. An allow-list routes only the named apps; a deny-list routes everything except them. Configuring one while expecting the other produces exactly this.
Cause five: IPv6
A tunnel that carries only IPv4 leaves IPv6 lookups and IPv6 traffic to take the normal path. On mobile networks, which are heavily IPv6, this can mean most of your traffic bypasses the tunnel entirely.
A tunnel routing ::/0 as well as 0.0.0.0/0 closes it. VPNmine's profiles
route both.
What "no leak" should look like
With a VPNmine tunnel up, the resolvers answering should be 1.1.1.1 and 1.0.0.1 — Cloudflare's, configured into the tunnel profile — reached through the tunnel, so Cloudflare sees the query arriving from the VPN server rather than from you.
Being exact about that matters more than a vague claim of private DNS. A provider that says lookups are handled by its own resolvers should be able to tell you which addresses those are; if the leak test shows something else, one of the two statements is wrong.
The checking order
- Private DNS set to Automatic.
- Browser secure DNS off.
- VPN settings screen shows only your VPN client.
- Split tunnelling model understood, if you use it.
- Tunnel routes IPv6.
Re-run the DNS leak test after each change rather than all at once, so you learn which one mattered.
When Private DNS is the better choice
If you are not running a VPN, Private DNS pointed at a resolver you trust is a genuine improvement: it stops your mobile carrier from reading your lookups on a network you cannot otherwise control.
The two are not competitors so much as overlapping tools. The only thing to avoid is running both while believing the VPN handles DNS, because it does not — Android's setting wins, quietly and by design.
