A DNS leak happens when your device sends DNS lookups (the requests that turn website names into IP addresses) to your normal internet provider instead of through your VPN, so your provider can still see which sites you visit.

Is a DNS leak dangerous?

It doesn't expose your IP to websites, but it undermines the privacy you expect from a VPN by revealing the domains you visit to your ISP or network operator.

Does encrypted DNS (DoH) stop DNS leaks?

It hides the content of DNS lookups from your network, but the DNS provider you chose still sees them. With a VPN, it's usually best to use the VPN's own DNS.

DNS Leak Test: What a DNS Leak Is and How to Fix It

Disclosure: Some links go to VPN providers via our /go/ links and may earn us a commission in future, at no cost to you. Disclosure

Last reviewed: 30 October 2026 · By the CloakMyIPAddress Privacy Desk

Live test

Your public IP Checking…

Connection

IPv4: —
IPv6: —
Location: —
ISP / network: —

Leak test

Checks whether WebRTC exposes a different IP than the one websites see, which DNS resolvers handle your lookups, and whether IPv6 takes a different route than IPv4.

Browser

Quick answer: a DNS leak means your VPN hides your IP, but your device still asks your internet provider’s DNS servers to look up every website name — so your provider can still see where you go. Run the test with your VPN on: if any resolver listed belongs to your home ISP, you have a leak. Fix it by enabling your VPN’s DNS leak protection, turning off “smart” DNS features, and disabling IPv6 if your VPN doesn’t support it.

What DNS is, in one paragraph

Computers connect using IP addresses, but people type names like example.com. The Domain Name System (DNS) translates names to addresses. Each time you open a site or an app checks a server, your device sends a DNS query to a resolver — normally run by your internet provider, unless you’ve chosen another (such as your VPN’s, Cloudflare’s 1.1.1.1 or Quad9). Traditional DNS queries are unencrypted, so whoever runs the resolver and anyone on the network path can see them.

What a DNS leak is

When you connect to a VPN, the VPN app should send your DNS queries through the encrypted tunnel to the VPN provider’s own resolvers. A DNS leak happens when some or all queries still go to your ISP’s (or a hotel’s, or an office’s) resolver outside the tunnel. Websites still see the VPN’s IP, but your ISP sees a list of every domain you visit.

Why leaks happen

The operating system picks the fastest resolver. Windows can send queries over several network adapters at once (“smart multi-homed name resolution”), so a query may go out over your normal connection.
IPv6. If the VPN only handles IPv4, DNS queries over IPv6 can bypass it. See IPv6 leak test.
Manual VPN setups (e.g. a raw OpenVPN or WireGuard config) without DNS settings.
Browser-level DNS settings. A browser with DNS over HTTPS (DoH) set to a specific provider will use it regardless of the VPN — not a leak to your ISP, but a different party seeing your lookups.
Transparent DNS proxies. Some ISPs intercept all traffic on port 53 and answer it themselves.
The VPN drops and there’s no kill switch.

How to run a DNS leak test properly

Disconnect your VPN and run the test. Note the resolvers shown — usually your ISP.
Connect your VPN and turn on its kill switch.
Run the test again. A standard test resolves a few unique random subdomains and records which resolvers asked for them.
Read the result:
- All resolvers belong to your VPN provider (or its data-centre partner) → no leak.
- Any resolver belongs to your ISP or local network → leak.
- Resolvers belong to a public DNS provider you configured (e.g. Cloudflare) → not an ISP leak, but that provider sees your lookups.
Repeat on each device and browser you use.

How to fix a DNS leak

Step 1: Fix it in the VPN app (all devices)

Most mainstream VPN apps include DNS leak protection. In settings look for “DNS leak protection”, “Use VPN DNS”, or custom DNS: off. Also enable the kill switch. If your VPN app doesn’t offer DNS leak protection at all, that’s a sign to switch providers. Providers such as Proton VPN (which runs its own DNS resolvers, per its 2025 Securitum no-logs report), Mullvad, NordVPN and Surfshark route DNS through their own servers in their official apps.

Step 2: Windows

Update the VPN app — many fixes are automatic.
If you use manual configs, set the VPN adapter’s DNS server to the provider’s DNS address.
Consider disabling IPv6 on your main adapter only if your VPN doesn’t support IPv6 (Control Panel → Network and Sharing Center → Change adapter settings → Properties → untick Internet Protocol Version 6).
Advanced users: disable “smart multi-homed name resolution” via Group Policy (Computer Configuration → Administrative Templates → Network → DNS Client → Turn off smart multi-homed name resolution → Enabled).

Step 3: macOS

Use the VPN provider’s app rather than a manual profile; it configures DNS for the tunnel. If you set custom DNS in System Settings → Network → Details → DNS, remove it while testing.

Step 4: Android

Android has Private DNS (Settings → Network & internet → Private DNS). If set to a specific hostname it will override the VPN’s DNS. Set it to Automatic or Off while using your VPN, and enable Always-on VPN and Block connections without VPN (Settings → Network & internet → VPN → ⚙).

Step 5: iPhone and iPad

Use the VPN’s official app. Remove any DNS configuration profiles (Settings → General → VPN & Device Management) that you don’t need, as they can override VPN DNS.

Step 6: Browsers

Check each browser’s secure DNS setting:

Firefox: Settings → Privacy & Security → DNS over HTTPS. “Default protection” lets Firefox decide; “Off” uses the system (and therefore VPN) resolver.
Chrome / Edge: Settings → Privacy and security → Security → Use secure DNS. When set to “With your current service provider”, it uses the system resolver.

DNS leak vs other leaks

Leak	What leaks	Test
DNS leak	The domain names you visit, to your ISP	This page
WebRTC leak	Your real IP, to websites via the browser	WebRTC leak test
IPv6 leak	Your real IPv6 address and traffic	IPv6 leak test

FAQ

What is a DNS leak? DNS lookups going to your ISP instead of through the VPN.

Is it dangerous? It doesn’t expose your IP to websites but reveals your browsing destinations to your ISP or network operator.

Does DoH stop leaks? It encrypts lookups but the chosen DNS provider still sees them; with a VPN, prefer the VPN’s DNS.

Sources

IETF RFC 1034 – Domain Names, Concepts and Facilities: https://www.rfc-editor.org/rfc/rfc1034
IETF RFC 8484 – DNS Queries over HTTPS (DoH): https://www.rfc-editor.org/rfc/rfc8484
Mozilla – Firefox DNS over HTTPS: https://support.mozilla.org/kb/firefox-dns-over-https
Google Chrome – secure DNS help: https://support.google.com/chrome/answer/10468685
Android – Private DNS: https://support.google.com/android/answer/9654714
Securitum – Proton VPN no-logs report 2025 (own DNS resolvers): https://securitum.com/public-reports/securitum-protonvpn-nologs-2025.pdf