What is a DNS Leak? How to Test and Fix It

Security • 15 May 2026

You’ve done everything right. You purchased a highly-rated Virtual Private Network (VPN), you connected to a server in another country, and you verified that your Public IP address has successfully changed. You feel completely anonymous. Unfortunately, there's a silent flaw that could still be exposing your entire browsing history to your Internet Service Provider (ISP): a DNS Leak.

The Vulnerability

In recent security tests, nearly 43% of free VPN apps were found to leak DNS requests.
A DNS leak exposes exactly which websites you are visiting, even if the content of the visit is encrypted.
Fixing a DNS leak takes less than 2 minutes once you identify it.

What is DNS? (The Internet's Phonebook)

Before understanding the leak, we must understand the system. DNS stands for Domain Name System.

Computers communicate using numbers (IP addresses), but humans communicate using words. When you type google.com into your browser, your computer doesn't know where that is. It must contact a DNS server and ask, "What is the IP address for google.com?" The DNS server looks it up in its directory and replies with the IP address (e.g., 142.250.190.46). Then, your browser connects to that IP.

By default, your ISP (Comcast, AT&T, Spectrum, etc.) provides your DNS servers. This means every single website you visit is logged by your ISP because they process the DNS request before you even load the page.

What Causes a DNS Leak?

When you connect to a VPN, the VPN software is supposed to take over all network traffic. It creates an encrypted tunnel, and all your DNS requests are supposed to go through this tunnel to the VPN provider's secure DNS servers.

A DNS Leak occurs when your computer's operating system bypasses the VPN tunnel and sends the DNS request to its default servers (your ISP's servers) outside the encrypted tunnel.

Why does the OS bypass the VPN?

Windows "Smart Multi-Homed Named Resolution": Windows 8, 10, and 11 have a feature designed to speed up web browsing. If the VPN's DNS server is taking a few milliseconds too long to respond, Windows will simultaneously query your ISP's DNS server and use whichever responds first. This immediately causes a leak.
Improper VPN Configuration: If the VPN app lacks built-in leak protection or is improperly configured, the OS simply defaults back to what it knows.
Teredo & IPv6 Conflicts: Sometimes, the VPN only routes IPv4 traffic, leaving IPv6 DNS requests completely unprotected.

Visualizing the Leak

Your Computer

Encrypted Data Tunnel

Leaking DNS Request

Your ISP

"Aha! They visited example.com"

How to Test for a DNS Leak

Testing for a DNS leak is incredibly easy. You don't need any technical skills; you just need to follow these exact steps:

Disconnect your VPN: Turn your VPN off.
Check your baseline: Go to a DNS leak testing website (like dnsleaktest.com) and run a "Standard Test". Write down the ISP names it shows (e.g., Comcast, Spectrum). This is your baseline.
Connect your VPN: Turn your VPN back on and connect to a server (preferably in a different country).
Run the test again: Refresh the DNS leak testing website and run the test again.

The Results: If the test shows the exact same ISP names as your baseline, you have a DNS leak. If the test shows completely different servers owned by your VPN company or a third party (like Cloudflare or Google), you are safe.

How to Fix a DNS Leak

If you discover that your VPN is leaking your DNS requests, you need to take immediate action to secure your privacy. Here are the most effective fixes:

1. Enable Built-In Leak Protection

Most premium VPN providers (like ExpressVPN, NordVPN, or Surfshark) have built-in "DNS Leak Protection" options. Open your VPN app's settings or preferences menu, find the security tab, and ensure that "DNS Leak Protection" and "IPv6 Leak Protection" are toggled ON.

2. Change Your DNS Servers Manually

Instead of relying on your ISP's default DNS servers, you can configure your router or your computer's network adapter to use secure, privacy-focused third-party DNS servers. By doing this, even if a leak occurs outside the VPN tunnel, the request goes to a privacy-respecting server instead of your ISP.

Excellent privacy-focused DNS providers include:

Cloudflare: 1.1.1.1 and 1.0.0.1
Quad9: 9.9.9.9 and 149.112.112.112
OpenDNS: 208.67.222.222 and 208.67.220.220

3. Disable Windows "Smart Multi-Homed Named Resolution"

If you are on Windows 10/11 and experience persistent leaks, you can force Windows to stop pinging all DNS servers simultaneously. This requires editing the Local Group Policy Editor (for Pro users) or the Registry (for Home users), which disables the "Turn off smart multi-homed name resolution" feature.

Frequently Asked Questions

Can a DNS leak expose my passwords?

No. A DNS leak only exposes the domain name of the website you are visiting (e.g., yourbank.com). It does not expose the specific pages you visit on that site, what you type, or your passwords, because the actual data connection remains encrypted via HTTPS and the VPN tunnel.

Does Incognito Mode stop DNS leaks?

No. Incognito Mode has absolutely zero effect on your network traffic. It only prevents your browser from saving local history and cookies. Your computer will still query your ISP's DNS server.

Should I just use a Proxy instead of a VPN?

Proxies are actually more prone to leaks than VPNs because they do not tunnel all your operating system's traffic. Read our Proxy vs VPN comparison to understand why a VPN with leak protection is much safer.