A DNS leak happens when your device sends DNS requests outside the private or protected connection you expected to use. This is most commonly discussed with VPNs, where your web traffic may go through the VPN tunnel, but your DNS requests may still go to your normal internet provider or another resolver.
DNS leaks matter because DNS requests can reveal which domain names your device is trying to visit, even when the actual website traffic is encrypted.
DNS stands for Domain Name System. It works like an address book for the internet. When you type a domain name such as example.com, your device uses DNS to find the IP address needed to connect to that website.
Without DNS, you would often need to remember numeric IP addresses instead of readable website names. DNS makes the internet easier to use, but it can also reveal information about the domains your device looks up.
A DNS resolver is the server that answers DNS lookup requests from your device. Your resolver may be provided by your internet provider, mobile carrier, workplace, school, router, VPN provider, or a public DNS service.
When checking for DNS leaks, the important question is whether your DNS requests are going to the resolver you expect. For example, when using a VPN, you may expect DNS requests to go through the VPN provider instead of your normal ISP.
DNS leaks can happen because of operating system settings, browser features, router configuration, VPN misconfiguration, IPv6 behavior, split tunneling, or custom DNS settings. Some apps may also use their own DNS behavior instead of following the system default.
A common example is a VPN connection that changes your visible IP address, while DNS requests still go to your ISP. In that case, websites may see the VPN IP, but DNS lookups may still reveal information to your normal DNS provider.
Many VPN apps include DNS leak protection. This usually means the VPN tries to force DNS requests through the VPN tunnel and use DNS resolvers controlled by, or selected by, the VPN provider.
If DNS leak protection is not enabled or does not work correctly, your browser may still resolve domains through your normal network. This can reduce the privacy benefit of using a VPN.
To check for a DNS leak, connect to your VPN and then use a DNS leak test tool. The test will show which DNS resolvers are answering your requests. If the results show your normal internet provider when you expected your VPN provider, you may have a DNS leak.
You should also compare your visible public IP address before and after connecting to the VPN. If your IP changes but your DNS resolver still belongs to your ISP, your DNS configuration may need adjustment.
Use a VPN with DNS leak protection, enable the VPN kill switch if available, and avoid mixing several DNS tools or privacy extensions without understanding how they interact. Also check whether your browser has secure DNS settings that override your system DNS.
On some networks, you may also need to review IPv6 settings, split tunneling rules, router DNS configuration, and custom DNS settings in your operating system.