Your DNS is leaking if, while the VPN is connected, the servers that answer your "where is this website" questions belong to your internet provider instead of the VPN. The connection looks fine, your IP address shows the VPN server, but the list of every domain you open still goes straight to the ISP. It is the most common VPN failure, it is invisible unless you test for it, and it takes about two minutes to check.

The two-minute test

  1. Connect the VPN and confirm it is on: open the What Is My IP page and check that the address and country belong to the VPN server.
  2. Open a DNS leak test site such as dnsleaktest.com or ipleak.net and run the extended test. The page makes your browser resolve a few dozen random hostnames and lists which DNS servers did the work.
  3. Read the list. If every server is in the VPN server's country and belongs to the VPN provider or a public resolver, you are fine. If you see your ISP's name, your home city, or a server in your own country while the VPN is elsewhere, DNS is leaking.
  4. Run the IPv6 leak test too. If it finds a local IPv6 address, more than DNS is leaking: the whole IPv6 path is outside the tunnel.
  5. Finish with the WebRTC leak test. This is a separate browser leak, not a DNS one, but you want it clean for the same reason.

Do the test on the network you actually use: home Wi-Fi, mobile data, and the office network can behave differently.

What a DNS leak exposes

The content of HTTPS pages stays encrypted whether DNS leaks or not. What leaks is the map of where you go: every domain, with a timestamp, tied to your real IP address. For an ISP that is a browsing history. For a coffee-shop network it is the same thing, visible to whoever runs the router. It also lets a website that logs DNS queries correlate the VPN's IP with your real one, which defeats the point of using a VPN.

Why DNS leaks happen

Windows asks everyone at once. Windows has a feature called smart multi-homed name resolution: it sends DNS queries over all network adapters in parallel and takes the fastest answer. With a VPN that means the query goes into the tunnel and to the ISP at the same time, and the ISP is often faster.

IPv6 goes around the tunnel. Many VPN apps only carry IPv4. If your network provides IPv6, the system happily uses it for DNS and for connections, outside the tunnel.

The browser has its own DNS. Chrome, Firefox and Edge can send DNS over HTTPS to a resolver of their choice. That hides queries from the ISP, but the request still leaves from your real IP, so the resolver knows who you are.

Split tunneling or per-app routing. If DNS traffic is not explicitly included in the tunnel, it takes the default route.

Transparent DNS proxies. Some ISPs intercept every packet on port 53 and answer it themselves, no matter which server you asked. Only encrypted DNS or a tunnel gets past that.

The moment of reconnection. Every time the tunnel drops and reconnects, there are a few seconds when the system falls back to the ISP's DNS. Only a kill switch prevents this.

How to fix it

Start in the VPN app. Look for a DNS leak protection setting, or an option to use the VPN's own DNS servers, and turn it on. Turn on the kill switch while you are there. Most leaks end here.

Windows. In the network adapter settings for your normal connection, set the DNS servers manually to the VPN's resolvers or a public encrypted resolver, so the fallback path no longer points at the ISP. If you are comfortable with advanced settings, disable smart multi-homed name resolution through the group policy editor under Computer Configuration → Administrative Templates → Network → DNS Client. Also untick "Internet Protocol Version 6" on the adapter unless your VPN supports IPv6.

macOS. In System Settings → Network, select your connection, open DNS, and put the VPN's resolver first. Under TCP/IP, set Configure IPv6 to Link-local only. Then reconnect the VPN.

iPhone and iPad. The VPN app's configuration profile handles DNS; make sure the app's DNS protection is on. If you use a DNS profile from another provider, remove it while the VPN is active, otherwise the two fight over the setting.

Android. Settings → Network & internet → Private DNS. Set it to Off or to the VPN's own hostname while using the VPN, because a third-party Private DNS hostname sends queries outside the tunnel. In the VPN's per-app settings, enable Always-on VPN and Block connections without VPN.

Router. If the VPN runs on the router, set the router's DNS to the VPN provider's resolvers and disable IPv6 on the WAN side unless the tunnel supports it.

Browser. Either turn off the browser's secure DNS setting and let the VPN handle it, or make sure that setting points to a resolver reached through the tunnel. Do not run both in different directions.

Verify, then verify after updates

Run the extended test again after every fix. Then get into the habit of re-running it after the app updates, after the operating system upgrades, and whenever you join a new network. DNS behaviour changes quietly, and the only way to know is to look.

A last check that is easy to forget: disconnect the VPN, run the test again, and make sure you are not accidentally using an old manual DNS entry that keeps pointing at a VPN server you no longer use. That would break browsing rather than leak anything, but it is confusing to debug later.

404 VPN's apps route DNS through the VLESS or WireGuard tunnel by default, include DNS leak protection, and have a kill switch that blocks traffic while the tunnel reconnects instead of letting it fall back to the ISP. You can read more on the security page, or get started and run the tests above on your own connection.