What is a DNS leak?
Also asked as: How do I know if my VPN is leaking DNS? · How do I fix a DNS leak?
Direct answer
A DNS leak is when your device sends its name lookups — "what is the address of example.com" — to your ISP's resolver outside the VPN tunnel. The traffic itself is still encrypted, but the ISP gets a list of every domain you visit. A DNS leak test shows which resolvers your lookups reach; a correct VPN shows only the provider's.
How it happens
Operating systems remember the resolver the network handed them and may keep using it after the tunnel comes up, or fall back to it when a lookup through the tunnel is slow. Some routers and some "smart" DNS features on Windows and macOS also send queries to every known resolver at once. None of these touches the tunnel; they just route the lookup around it.
How to test and fix it
Run a DNS leak test with the VPN connected. You should see only resolvers belonging to the VPN provider; seeing your ISP's means a leak. Fixes are per platform — set the adapter's DNS to the tunnel, disable smart multi-homed name resolution on Windows, use the VPN app's own DNS setting on Android — and the guides below walk through each.
On VPNmine
VPNmine's apps send DNS through the tunnel. The DNS leak test on this site runs against a nameserver VPNmine operates and reports the resolvers that actually asked, so you can confirm it on your own device in a few seconds.
Related questions
- Does a VPN hide my IP address?A VPN replaces the IP address websites see with the server's. Where that holds, where it leaks (DNS, WebRTC, IPv6), and how to check your exit address.
- Can my ISP see that I use a VPN?Your ISP can see that you are connected to a VPN server, how much data moves and when. It cannot see the sites, the lookups or the content. What that means.
- Does a VPN make internet browsing private?A VPN hides browsing from your network and ISP and hides your address from sites. It does not hide you from accounts, or from the VPN provider itself.
- How does a VPN work?What happens when you press connect: key exchange, encrypted tunnel, a server that forwards your traffic, and why sites see its address, not yours.