How to Fix DNS Leaks When Connected to a VPN on Windows 11

Security • 4 September 2026

When you connect to a Virtual Private Network (VPN) on Windows 11, your internet traffic is supposed to travel through an encrypted tunnel, routing both your IP traffic and Domain Name System (DNS) requests through the VPN's secure servers. However, operating system features in Windows 11 can sometimes cause your device to send DNS queries directly to your Internet Service Provider (ISP) instead. This security flaw is known as a DNS leak.

A DNS leak compromises your privacy by exposing the websites you visit, your general location, and your online habits to your ISP and potential third parties. In this guide, we will break down why DNS leaks happen on Windows 11 and walk through actionable, expert-tested solutions to eliminate them completely.

Understanding Why DNS Leaks Happen on Windows 11

Windows 11 prioritizes connection speed and network responsiveness, which occasionally comes at the expense of VPN privacy features. The most common causes of DNS leaks include:

Smart Multi-Homed Name Resolution (SMHNR): A built-in Windows feature that sends DNS requests across all available network interfaces (Ethernet, Wi-Fi, VPN) simultaneously and accepts the response from the fastest server.
Unprotected IPv6 Traffic: Many VPNs only handle IPv4 traffic. If IPv6 is enabled on your Windows 11 network adapter, IPv6 DNS requests may bypass the VPN tunnel.
Misconfigured VPN Settings: Failing to enable built-in DNS leak protection or kill switch mechanisms within your VPN client.
Manual DNS Overrides: Static DNS settings applied directly to your physical network adapters that override the VPN configuration.

Step 1: Test Your Connection for DNS Leaks

Before applying fixes, you need to verify whether your Windows 11 system is actively leaking DNS requests.

Disconnect your VPN and note your default IP address and DNS servers provided by your ISP.
Connect to your VPN server of choice.
Visit a reputable leak test site such as DNSleaktest.com.
Run the Extended Test.

If the test results display servers belonging to your ISP (or any provider other than your VPN vendor), your system is leaking DNS requests.

Step 2: Disable Smart Multi-Homed Name Resolution (SMHNR)

Disabling SMHNR prevents Windows 11 from distributing DNS queries across non-VPN adapters. You can disable this via the Group Policy Editor (Windows 11 Pro/Enterprise) or the Registry Editor (Windows 11 Home).

Method A: Using Group Policy Editor (Windows 11 Pro & Enterprise)

To disable SMHNR via Group Policy:

Press Win + R, type gpedit.msc, and press Enter.
Navigate to: Computer Configuration > Administrative Templates > Network > DNS Client.
Double-click on Turn off smart multi-homed name resolution.
Select Enabled (enabling this policy turns the multi-homed resolution feature off).
Click Apply and then OK.

Method B: Using Registry Editor (Windows 11 Home)

If you run Windows 11 Home, you can achieve the same result via the Windows Registry:

Press Win + R, type regedit, and press Enter.
Navigate to: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient
If the DNSClient key does not exist, right-click Windows NT, select New > Key, and name it DNSClient.
Right-click inside the right pane of DNSClient, select New > DWORD (32-bit) Value, and name it DisableSmartNameResolution.
Double-click DisableSmartNameResolution and set its Value data to 1.
Click OK and restart your computer.

Step 3: Disable IPv6 on Windows 11 Network Adapters

If your VPN provider does not support native IPv6 routing, disabling IPv6 forces all traffic over the secure IPv4 VPN tunnel. You can learn more about network protocols through Cloudflare's DNS Learning Center.

Follow these steps to disable IPv6:

Press Win + R, type ncpa.cpl, and press Enter to open Network Connections.
Right-click your active Wi-Fi or Ethernet adapter and select Properties.
Scroll down the list and uncheck Internet Protocol Version 6 (TCP/IPv6).
Click OK to save the changes.
Repeat this process for any other active physical adapters on your device.

Step 4: Enable Built-in VPN Leak Protection Features

Most top-tier commercial VPN providers include native leak mitigation within their application settings. Ensure the following configurations are active within your VPN app:

DNS Leak Protection: Turn on explicit DNS leak protection toggles in your VPN app's connection settings.
Enable VPN Kill Switch: A kill switch blocks all internet traffic if the VPN connection drops unexpectedly, preventing accidental leaks.
Force Exclusive VPN DNS: Ensure your app is set to force the OS to use only the VPN's custom DNS servers while connected.

Step 5: Flush DNS Cache and Reset Network Settings

Stale or cached DNS records on Windows 11 can resolve domain queries locally using your ISP's historic records. Clearing this cache resolves lingering leak issues.

Press the Windows Key, search for cmd, right-click Command Prompt, and select Run as administrator.
Type the following commands one by one, pressing Enter after each:

ipconfig /flushdns
netsh winsock reset
netsh int ip reset

After executing these commands, restart your PC. Reconnect to your VPN and run another DNS leak test. Your primary network interface should now route all requests strictly through your VPN provider's secure servers.

Final Thoughts

Fixing DNS leaks on Windows 11 requires disabling OS features like Smart Multi-Homed Name Resolution and IPv6 traffic that interfere with VPN tunnels. By following the steps above and regularly testing your connection, you can ensure your online identity and internet activity remain completely private.