You can have a flawless VPN tunnel — AES-256, audited no-logs policy, Perfect Forward Secrecy — and still leak a nearly complete record of every site you visit. Not through the tunnel itself, but through a system most users never think about at all: the Domain Name System, or DNS. This is the part of the internet that translates a name like “example.com” into an IP address, and it happens constantly, silently, in the background of every single web request you make.
Why DNS Is a Privacy Problem in the First Place
Traditionally, DNS queries are sent unencrypted. Before your browser can even load a page, your device asks a DNS resolver “what’s the address for this domain?” — and historically, that question travels in plain text, visible to anyone positioned to see it: your internet service provider, anyone on the same network, or any router the query happens to pass through. Even if the actual webpage content that follows is fully encrypted with HTTPS, the DNS query itself reveals exactly which domains you’re requesting, in order, with timestamps.
That’s a remarkably complete picture. A list of every domain you queried, in sequence, is close to a full browsing history — even without ever seeing the content of a single page.
How This Leaks Even When You’re “Using a VPN”
A properly configured VPN should route DNS queries through its own encrypted tunnel, to its own private DNS resolvers. But several common failure modes break this:
- Operating system DNS caching or “smart” multi-homed resolution — some systems, particularly certain Windows and Android configurations, can query multiple DNS servers simultaneously, including your regular ISP resolver, even while a VPN is active.
- Split tunneling misconfiguration — when only some traffic is routed through the VPN, DNS queries can end up following the non-VPN path by default.
- IPv6 traffic bypassing an IPv4-only tunnel — if a VPN doesn’t fully handle IPv6, DNS and other traffic over IPv6 can leak outside the tunnel entirely, invisible unless specifically tested for.
- Browser-level DNS settings overriding system/VPN settings — some browsers implement their own DNS-over-HTTPS configuration that can route queries to a different resolver than the one the VPN intends.
A VPN can encrypt the destination of your traffic perfectly, and still leave the map of where you’ve been sitting in plain view — because DNS is a separate system that has to be deliberately, correctly folded into the tunnel.
Encrypted DNS: DoH, DoT, and DNSCrypt
The industry response to unencrypted DNS has been a set of protocols that wrap DNS queries in encryption:
| Protocol | How it works | Common use |
|---|---|---|
| DNS-over-HTTPS (DoH) | Wraps DNS queries inside standard HTTPS traffic | Browsers, some OS-level settings |
| DNS-over-TLS (DoT) | Encrypts DNS over a dedicated TLS connection | OS-level and router configurations |
| DNSCrypt | Authenticates and encrypts queries with a custom protocol | Privacy-focused resolver software |
Encrypting DNS solves the visibility problem for outside observers, but it introduces a new question: who runs the resolver you’re now trusting with an encrypted-but-still-centralized list of every domain you query? This is why the most privacy-respecting VPN providers run their own private DNS infrastructure rather than routing encrypted queries to a large third-party resolver that could itself build a profile over time.
Testing for DNS Leaks Yourself
- Connect to your VPN as you normally would.
- Visit a dedicated DNS leak test tool and run the extended test, not just the basic one.
- Compare the DNS resolver location(s) shown against your actual VPN server location — they should match.
- If your ISP’s name or region appears anywhere in the results, DNS is leaking outside the tunnel.
- Repeat the test with IPv6 enabled and disabled separately, since leaks often hide specifically in the IPv6 path.
What a Well-Built VPN Does Differently
Providers that treat DNS seriously typically run their own encrypted DNS resolvers inside the same tunnel infrastructure as their VPN traffic, actively block queries from escaping to any external resolver at the operating-system level, and include a dedicated DNS/IPv6 leak-protection toggle in the app rather than assuming default behavior is safe. Some go further with a full kill switch that cuts all network access — not just VPN traffic — the moment the tunnel drops, which also prevents DNS queries from silently falling back to an unprotected path during a disconnection.
Router-Level and Smart Home Considerations
DNS leak risks aren’t limited to laptops and phones. Increasingly, households run a VPN client directly on a router, aiming to protect every device on the network at once, including smart TVs, game consoles, and IoT devices that can’t run a VPN app of their own. This setup introduces its own DNS-specific pitfalls: many consumer routers ship with a default DNS resolver hardcoded into their firmware, and unless that default is explicitly overridden as part of the VPN configuration, individual devices on the network can end up querying the router’s built-in resolver directly, bypassing the VPN’s DNS handling entirely even while their general internet traffic passes through the tunnel correctly.
This is a particularly easy failure mode to miss, because the symptoms are invisible during normal use — video streams still load, websites still work, and nothing about the browsing experience signals that DNS queries are taking a different path than the rest of the traffic. It typically only surfaces during a dedicated leak test, which is one more reason router-level VPN setups deserve the same testing discipline as a single-device VPN app, if not more, given how many devices are relying on that one configuration being correct.
Public Wi-Fi: Where DNS Leaks Matter Most
The practical stakes of a DNS leak scale with how hostile the network you’re connected to is. On a home network, a leaked DNS query is primarily visible to your own internet provider. On public Wi-Fi — a coffee shop, an airport, a hotel — the network operator, and potentially anyone else sharing that network with the right tools, can be positioned to observe unencrypted DNS traffic directly. This is exactly the situation a VPN is most commonly used to protect against, which makes a DNS leak in that specific context especially counterproductive: the user has taken the extra step of connecting to a VPN specifically because they don’t trust the local network, while an undetected leak quietly hands that same untrusted network a list of every domain being visited anyway.
Frequently Asked Questions
Does using a private or “incognito” browser window prevent DNS leaks?
No. Private browsing modes primarily prevent local storage of browsing history, cookies, and cache on your own device. They have no effect on how DNS queries are routed at the operating system or network level, and offer no protection against a DNS leak.
If I use a well-known public DNS resolver instead of my ISP’s default, am I safe from leaks?
Manually switching to a public resolver can reduce reliance on your ISP’s resolver, but it doesn’t guarantee the query travels through your VPN’s encrypted tunnel — the query can still leak outside the tunnel entirely, just to a different destination than before. The tunnel routing is the part that matters, not merely which resolver is the final destination.
Can a DNS leak happen even with a kill switch enabled?
A kill switch is designed to block all network traffic if the VPN tunnel drops unexpectedly, which does help prevent leaks during a disconnection event specifically. However, it does not address leaks that occur while the VPN is actively connected but DNS is misconfigured to bypass the tunnel — those are two distinct problems with two distinct fixes.
How often should I re-test for DNS leaks?
It’s worth testing after any change to your setup — a new device, an app update, switching VPN protocols, or a new network like a hotel or office Wi-Fi — rather than assuming a single past test remains valid indefinitely, since configuration changes on either the device or network side can reintroduce a leak that wasn’t present before.
Do encrypted DNS protocols like DoH make a VPN unnecessary?
No. Encrypted DNS on its own only protects the domain-lookup step of a connection; it does nothing to hide your actual IP address from the sites you visit, nor does it encrypt the broader traffic content the way a VPN tunnel does. The two technologies address different, complementary parts of the privacy picture — encrypted DNS protects what you’re asking for, while a VPN protects where that request appears to come from and what happens to the traffic in between.
Why doesn’t every VPN just run its own private DNS resolver by default?
Running dedicated DNS infrastructure alongside a VPN’s server network adds engineering and operational overhead, and it requires ongoing maintenance to keep resolvers fast, reliable, and genuinely free of logging, rather than simply forwarding queries to a larger third-party resolver as a shortcut. Providers that treat this as worth the investment are generally signaling that DNS privacy is being taken seriously as part of the product, not bolted on as an afterthought.
The Takeaway
Strong encryption inside a VPN tunnel answers the question “can someone read my traffic?” It doesn’t automatically answer “can someone see which sites I’m requesting in the first place?” Those are different systems, and a genuinely privacy-focused VPN treats DNS handling as a first-class engineering problem — not an afterthought solved by default operating system behavior. Before trusting any VPN with sensitive activity, run a leak test yourself. It takes two minutes, and it’s one of the few privacy claims you can verify directly, with your own eyes, rather than having to take anyone’s word for it.
Leave a Reply