Online Tool Store
· 5 min read
How to Check Whether Your VPN Is Leaking DNS
Heshan Fernando
Co-founder & COO
Your VPN says connected. The little icon is green. And yet a leak test page reports a resolver belonging to your home internet provider rather than the VPN, which means something is going around the tunnel — and the thing going around it is the list of every domain you visit.
DNS leaks are a common and quietly consequential misconfiguration, partly because everything appears to be working. Your traffic is encrypted. Your apparent IP address has changed. It’s only the name lookups that are escaping.
What a DNS leak actually is
Before your device connects to a site, it asks a DNS resolver to turn the domain name into an IP address. That query is a separate operation from the connection itself.
When a VPN is working correctly, the query goes through the tunnel to a resolver the VPN provides. When it leaks, the query goes to whatever resolver the device was configured to use before the VPN connected — typically your internet provider’s.
The consequence is specific: your provider, or whoever operates that resolver, sees a timestamped list of the domains you look up. Not the pages, not the content, but the domain names, which is often enough to reconstruct a great deal.
Leaks happen for several ordinary reasons. The operating system may split queries across multiple interfaces. An application may have its own hardcoded resolver. IPv6 may be routing outside a tunnel that only handles IPv4. Or the VPN may simply not be configured to push its own resolver settings.
Why people get stuck here
- Everything looks fine. A green connection icon says nothing about DNS.
- Test results are hard to interpret. A page listing three resolvers you don’t recognise doesn’t tell you whether that’s expected.
- IPv6 is invisible. A tunnel handling only IPv4 while the system prefers IPv6 leaks constantly and silently.
- Browser-level DNS. Some browsers do their own encrypted DNS, which can bypass system settings in either direction.
- It’s intermittent. A leak on reconnect after sleep won’t show up in a test run right after a clean connect.
| Symptom | Likely Cause | What To Check |
|---|---|---|
| Provider’s resolver appears | System DNS not routed through tunnel | VPN’s DNS setting and kill switch |
| Different resolver per test | Split-interface resolution | Interface-level DNS configuration |
| Leak only after sleep | Reconnect not restoring settings | Test after waking, not just after connecting |
| IPv6 address leaks | IPv6 outside the tunnel | Whether the VPN handles IPv6 at all |
What a proper check involves
Test more than once, in more than one state
A single test right after connecting is the most favourable condition possible. Test after a reconnect, after waking from sleep, and after switching networks.
Check IPv6 separately
If your connection has IPv6 and your VPN doesn’t handle it, you have a leak regardless of what the IPv4 test says.
Know what the expected answer is
You can’t identify an unexpected resolver without knowing which one you expect. Find out which resolver your VPN uses before testing.
Verify the kill switch
A kill switch that blocks traffic when the tunnel drops is what protects you between disconnect and reconnect — the window where most real-world leaks occur.
Common mistakes to avoid
- Testing only once. Leaks are frequently intermittent and tied to reconnection.
- Ignoring the browser’s own DNS setting. Encrypted DNS in the browser is a separate layer and can produce confusing results either way.
- Assuming a leak test proves anonymity. No DNS leak means one specific problem is absent, not that you’re anonymous.
- Setting a public resolver manually and calling it fixed. That changes who sees the queries, not whether they leave the tunnel.
- Ignoring other devices. The phone on the same network usually isn’t on the VPN at all.
How to do it with DNS Leak Tester
Online Tool Store’s DNS Leak Tester walks through the test steps and resolver checklist in your browser, with nothing uploaded anywhere.
- Find out which resolver your VPN is supposed to use, before testing anything.
- Connect the VPN, then work through the checklist to see which resolver your device is actually reaching.
- Repeat after disconnecting and reconnecting, and again after the machine has been asleep.
- Check IPv6 specifically, since an IPv4-only tunnel leaks it entirely.
- If a leak shows up, check your VPN’s DNS setting and kill switch first — that’s the cause in most cases.
- Re-test after any change, and re-test periodically since operating system updates reset network settings more often than you’d expect.
The WebRTC Leak Test, What’s My IP, and the Browser Fingerprint Audit cover the adjacent checks.
Frequently asked questions
What does a DNS leak actually expose?
The domain names you look up, along with timestamps, to whoever operates the resolver receiving them. Not the page contents or the specific URLs, but a domain-level record of your browsing — which is more revealing than most people assume.
Does using an encrypted DNS service fix a leak?
It changes who can read the queries in transit and who receives them, but the queries are still bypassing the tunnel. That’s an improvement in some threat models and no help at all if your concern is that the traffic leaves the VPN.
How often should I test?
After setting up a VPN, after any operating system update, and periodically otherwise. Network configuration gets reset by updates more often than you’d think, and the failure is silent.
Final thought
Test after a reconnect, not after a clean connect. The state you’re actually in most of the day is the one worth checking, and it’s the one most tests never look at.