What Is a DNS Leak? Why Lookups Escape the VPN and How to Stop It

A DNS leak means the VPN carries your traffic, yet the domain-name lookups your device sends travel outside it, typically to the internet provider's resolver. That resolver sees the names of every site you open plus your real public IP. The website itself still sees the VPN server's address, pages load normally, and an IP check shows the VPN country, so without a leak test you would never notice anything.

Where a lookup goes when things work and when they leak

Before connecting to any site, the device asks the resolver for the IP behind the domain. A healthy tunnel carries that question, already encrypted, to a resolver operated by the VPN provider. When something leaks, the query takes the physical adapter instead and lands at the ISP's resolver, which can log your browsing history next to your real IP.

Why lookups escape the tunnel

Checking for a leak and reading the result

A test page makes the browser resolve random one-off subdomains of the tester's domain, and the tester's name server records which resolvers asked, showing their IP, owner and country. Seeing only the VPN provider, or the DNS service it publishes, means things are fine. Your home ISP's name or your real country signals a leak, while an unfamiliar big public resolver usually points at browser secure DNS or a stale adapter setting.

Run it connected, repeat after a reconnect, and check each network you use, from your own Wi-Fi to mobile data and the hotel. A browser test covers the browser's path only. To see what the system itself uses, try nslookup on Windows or, on Linux, resolvectl status.

What a well-built VPN app does about it

The app hands your device a resolver that sits on the VPN server you connect to, reachable only through the tunnel, and pairs it with firewall rules that block port 53 on all other interfaces. These two measures together shut the usual escape routes described above: stale adapter DNS, the Windows multi-homed race and plain port 53 traffic. OpenVPN has a dedicated switch, block-outside-dns, described in the OpenVPN 2.6 manual: it works on Windows, where it blocks TCP and UDP port 53 on other adapters, while other operating systems treat the option as unknown. In a WireGuard config, the DNS line in the [Interface] section does the pushing; delete it and the system keeps its usual resolver. A kill switch covers the seconds of a reconnect.

DNS leak protection in VPNRadarLab data and scores

In the main ranking of 377 services, 115 claim DNS leak protection, 1 marks it as partial, 10 say no, and 251 do not state it. Not stating means the provider does not publish the information, which is not the same as not having it. Several of the 10 denials come from third-party reviews that caught leaks in testing. In the main ranking, 59 services publish that they run their own resolvers, and 7 say they do not. Across the whole catalogue of 543 consumer VPNs shown in the page intro, 124 claim the protection, 11 deny it and 408 stay silent; the ranking page lists those 124.

The criterion is one of eleven in the security sub-score, worth 1.5 of its 14 points. The security sub-score itself weighs 20% of the total in the main ranking and 40% on the security section pages. A service that says nothing about DNS leak protection earns 0 for this criterion, the same as one that denies it; there is no extra penalty beyond that.

FAQ

Is a DNS leak dangerous if my traffic stays encrypted?

Yes, for privacy. Page content remains sealed, yet your internet provider gets a timeline of the domains you looked up, tied to your real IP.

Does a DNS leak expose my IP address?

To the outside resolver, yes, along with the domains. The website still sees only the VPN server's address.

Does switching to a public resolver fix a leak?

No. Lookups still travel outside the tunnel, and a provider with a transparent DNS proxy answers port 53 traffic regardless of the destination you set.

Key points on DNS leaks

A DNS leak sends your domain lookups to a resolver outside the tunnel, so your internet provider learns which sites you open plus your real IP, while the website still sees only the VPN address, and an IP check reveals nothing. Test on every network you use, right after connecting and after a reconnect. Pick a client that pushes its own tunnel-only resolver, blocks port 53 outside the tunnel and has a kill switch.