Online Tool Store
· 5 min read
What Is a DNS Leak and How Do You Check for One?
Heshan Fernando
Co-founder & COO
You turned on your VPN, checked that your IP address changed, and assumed your browsing was private end to end. Then you read a forum thread mentioning “DNS leaks” and realized you have no idea whether the sites you visit are still being logged by your regular internet provider anyway, VPN or not. It’s a reasonable thing to wonder, and most people genuinely don’t know how to check.
The confusing part is that a DNS leak doesn’t look like anything broken — your VPN still shows as connected, your IP address still shows as changed, and browsing works exactly the same. The leak happens quietly, in a background process most people never think about.
What a DNS leak actually is
Every time you visit a website, your device needs to translate a domain name like example.com into an IP address — that lookup is a DNS request. Normally, when you’re using a VPN, those DNS requests should be routed through the VPN’s own DNS servers, keeping them just as private as your regular browsing traffic.
A DNS leak happens when your device bypasses the VPN’s DNS servers and sends those lookup requests to your regular internet provider’s DNS servers instead — even while the rest of your traffic is correctly routed through the VPN. The result: your VPN is hiding your IP address, but your internet provider can still see a list of every domain you’re looking up, because the DNS requests never went through the tunnel.
Why DNS leaks happen even with a VPN turned on
- Operating system DNS settings override the VPN. Some systems keep using a manually configured DNS server regardless of what a VPN app requests.
- IPv6 traffic isn’t covered. A VPN configured only to handle IPv4 traffic can let IPv6 DNS requests leak out unprotected if your network also supports IPv6.
- Smart multi-homed resolvers. Some operating systems query multiple DNS servers simultaneously for speed, which can include your regular provider even when a VPN is active.
- VPN app not actually redirecting DNS. Not every VPN, especially free or poorly configured ones, correctly forces all DNS traffic through the encrypted tunnel by default.
How to actually test for a DNS leak
Establish a baseline first
Before connecting to your VPN, check what DNS servers you’re normally using, so you have something to compare against once the VPN is active.
Connect your VPN, then test again
With the VPN active, run a DNS leak test and check whether the DNS servers shown belong to your VPN provider or to your regular internet provider — if it’s still your regular provider, that’s the leak.
Check both IPv4 and IPv6 results
A leak can show up in one and not the other, so don’t stop checking after confirming IPv4 looks clean if the test also reports IPv6 results.
Common mistakes to avoid
- Assuming a changed IP address means DNS is also protected — they’re separate mechanisms, and one can be fine while the other leaks.
- Only testing once, right after connecting — reconnect and retest occasionally, since some leaks are intermittent depending on network conditions.
- Ignoring IPv6 results because IPv4 came back clean.
- Not checking whether your VPN app has a specific “DNS leak protection” setting that needs to be manually enabled rather than assumed on by default.
How to check for one with the DNS Leak Explainer
Online Tool Store’s DNS Leak Explainer walks through what a DNS leak is and exactly how to test for and fix one, step by step.
- Read through what’s actually happening during a DNS lookup, so the test results make sense once you run them.
- Follow the guide’s steps to check your DNS servers before and after connecting your VPN.
- Compare the results against your VPN provider’s DNS servers to confirm whether a leak exists.
- Use the fix guidance for your specific situation — whether that’s an OS-level DNS setting or a VPN app configuration.
Understanding the mechanism first makes the actual test result mean something, instead of just seeing a pass/fail with no context for what to do next if it fails.
Frequently asked questions
Does having a VPN automatically protect my DNS requests?
Not automatically — it depends on whether the VPN is correctly configured to route all DNS traffic through its own encrypted tunnel, including both IPv4 and IPv6. Many VPNs handle this well by default, but not all, and system-level settings can sometimes override it.
How often should I check for a DNS leak?
Checking once after setting up a new VPN is a reasonable baseline, and it’s worth rechecking after any operating system update, network change, or VPN app update, since any of those can reset DNS settings without you noticing.
If I find a DNS leak, does that mean my VPN is broken?
Not necessarily broken, but misconfigured for your setup — most leaks are fixable through a DNS setting either in the VPN app itself or at the operating system level, rather than requiring a different VPN entirely.
Final thought
A DNS leak is invisible by nature — nothing in your normal browsing experience changes when it happens, which is exactly why it’s worth actually testing for instead of assuming your VPN has it covered.