vpnandprivacy

security

How to fix a DNS leak

What a DNS leak is, why Windows causes most of them, how to confirm one from a terminal, and the exact setting to change on each platform so your queries go through the

By The VPN and Privacy team Updated 6 Sept 2026 Facts re-checked 6 Sept 2026 6 min read
Where a DNS query goes with and without a leak Your app asks where example.com is. The correct path sends the query through the encrypted tunnel to the VPN provider's DNS resolver. The leaking path sends it outside the tunnel to your ISP's DNS resolver from your real IP, giving the ISP a list of every domain you visit. Your app asks where is example.com? encrypted tunnel query travels inside nobody outside sees it VPN DNS resolver correct: no leak outside the tunnel, from your real IP ISP DNS resolver leak: ISP logs the domain Windows sends the query out of every adapter at once and takes the first answer
A DNS leak sends the "where is this site" question to your ISP's resolver outside the tunnel instead of to the VPN's.

What is leaking, and to whom

Every time you open a site your device asks a name server to turn the domain into an IP address. That query is separate from the traffic it precedes. When the VPN is working, the query goes through the tunnel to the provider’s resolver and nobody outside sees it. When DNS leaks, the query goes to your internet provider’s resolver instead, over the ordinary connection, from your real address.

The result is that your ISP has a timestamped list of every domain you visited, which is precisely the record a VPN is bought to prevent — and in the UK and Australia the record it is legally required to keep.

Confirming it

A web page cannot see which resolver answered its queries, so any browser-based “DNS leak test” is inferring rather than measuring. The leak test on this site says so plainly and gives you the command instead. With the VPN connected:

nslookup -type=txt whoami.cloudflare 1.1.1.1

The address in the reply is the resolver that made the request on your behalf. If it belongs to your ISP, DNS is leaking. If it belongs to your VPN provider or a datacentre range, it is not.

On macOS or Linux you can also check what the system thinks it should be using:

scutil --dns | grep nameserver          # macOS
resolvectl status | grep 'DNS Servers'  # Linux with systemd
Get-DnsClientServerAddress              # Windows PowerShell

Fixing it on Windows

Windows causes most DNS leaks, because Smart Multi-Homed Name Resolution deliberately sends each query out of every adapter at once and takes the first answer. Two fixes, and doing both is reasonable.

In the VPN app: turn on “DNS leak protection”, “Use VPN DNS” or “Block outside DNS”. Every provider recommended on this site has this; on some it is on by default.

In Group Policy (Windows Pro): Computer Configuration → Administrative Templates → Network → DNS Client → Turn off smart multi-homed name resolution → Enabled. On Windows Home, the equivalent registry value is DisableSmartNameResolution under HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters, set to 1.

Also check that IPv6 is not going around the tunnel: if your VPN does not carry IPv6, disable it on the adapter, or move to a provider that does.

macOS

macOS is better behaved, and the usual cause is a manually configured DNS server left in System Settings → Network → Details → DNS. Remove entries there and let the VPN set them. If the app offers a permanent kill switch, turn it on — it also prevents the wake-from-sleep gap where queries escape before the tunnel is back.

iPhone and iPad

iOS routes DNS through the tunnel when the VPN profile is configured correctly, and the common cause of leaks is a third-party DNS profile installed earlier, from a content blocker or a “secure DNS” app. Settings → General → VPN & Device Management → DNS: set it to Automatic while the VPN is connected. Also turn on the app’s Always-On or on-demand setting so the system, not the app, maintains the tunnel.

Android

Android’s Private DNS setting can override the VPN. Settings → Network & internet → Private DNS → set to Automatic while using a VPN. Then turn on Always-on VPN with “Block connections without VPN”, which stops queries escaping when the app is suspended.

After the fix

Re-run the terminal check with the VPN connected. The resolver should now belong to the provider. If it still does not, the app’s DNS handling is the problem rather than the operating system’s, and that is a reason to change provider: every one on the best VPN list handles this correctly by default.

Frequently asked questions

What is a DNS leak?

Your device asking a name server outside the VPN tunnel to translate a domain into an address. The content of your traffic stays encrypted, but the query itself names every site you visit, and it goes to your ISP's resolver, which is exactly what the VPN was meant to prevent.

How do I check for a DNS leak?

From a terminal with the VPN connected, run nslookup -type=txt whoami.cloudflare 1.1.1.1. The address it returns is the resolver that asked on your behalf. If it belongs to your ISP rather than your VPN provider, DNS is leaking.

Why does Windows leak DNS more than other systems?

Because of Smart Multi-Homed Name Resolution, introduced in Windows 8, which sends every query out of all network adapters simultaneously and uses the fastest reply. Your ISP's resolver often replies first, so it sees the query even though the VPN is up.

Does a DNS leak expose what I do?

It exposes which domains you visit, with timestamps, to whoever runs the resolver. It does not expose page contents. For most people the domain list is the sensitive part, which is why this matters.

Can I just set my DNS to 1.1.1.1 manually?

That stops your ISP seeing the queries but hands them to Cloudflare instead, and if the query bypasses the tunnel it also links your real IP to the lookups. With a VPN connected, let the VPN handle DNS; manual public resolvers are for when you are not using one.