Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

VPN problems

DNS requests bypassing your VPN: how to find and fix them

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:DNS Leak TestAm I Using a VPN?Full Privacy Scan

Before your browser loads a site it asks a DNS server to turn the name into an address. With a working VPN those questions travel inside the tunnel to the VPN's resolver. When they go to your internet provider's resolver instead, your provider can see which sites you look up even though the pages themselves are encrypted. That is a DNS leak, and your IP can look perfectly hidden while it happens. For the background, read do VPNs leak DNS; this guide focuses on fixing it.

Confirm you have a leak

Connect your VPN and run the DNS leak test. If the resolvers shown belong to your own provider (not your VPN or a resolver you chose), requests are bypassing the tunnel. If the result is inconclusive, run it again. The test reports what it could observe and does not guarantee the absence of other leaks.

Why it happens

  • The operating system chooses the resolver. Windows can send queries over every network adapter and use the fastest answer, which may come from your provider.
  • The VPN does not set its own DNS. Some manual or router-based setups tunnel traffic but leave DNS settings alone.
  • Encrypted DNS in the browser. Browser "secure DNS" can send lookups to a third-party resolver, bypassing the VPN's.
  • IPv6 DNS. Your network may advertise an IPv6 resolver the VPN does not handle.

Fixes by device

All devices: use the VPN's own settings first

Turn on "DNS leak protection" or similar and update the app. Try a different protocol. Retest.

Windows

Use the VPN's official app rather than the built-in connection when possible, as it can lock down DNS. Check that no manual DNS servers are set on your adapters, or set them to the VPN's resolver. Disable IPv6 on the adapter if the VPN does not support it.

macOS

Open System Settings, Network, your connection, DNS, and remove any servers you added by hand so the VPN's can apply. Use the provider's app.

Android

Check Private DNS (in network settings). If set to a provider such as automatic, it may override the VPN. Set it to Off while using the VPN, or to the same resolver the VPN uses.

iPhone and iPad

Remove any DNS profile or custom DNS under your Wi-Fi network's settings, and use the VPN's app, which manages DNS for the tunnel.

Browser

If secure DNS is on in your browser, set it to follow the system resolver or turn it off while the VPN is on.

Retest

Run the DNS leak test again, then the full privacy scan. If you want to choose a resolver yourself, see how to change your DNS server.

A clean DNS test means no leak was observed in this test. It does not make your browsing anonymous.

Tools that can help

Privacy-focused DNS

What it does: Change which company answers your website lookups, and can block known malicious or tracking domains. What it does not do: Hide your IP address, stop browser fingerprinting, or hide which sites you visit from your internet provider (it can still see the connection).

  • Quad9FreeNo commissionFree public resolver run by a non-profit that blocks known malicious domains. Visit site
  • Cloudflare 1.1.1.1FreeNo commissionFree public resolver focused on speed, with optional malware-blocking addresses. Visit site

We list free and built-in options first. How we choose.

Keep reading

Do VPNs Leak DNS?Why a VPN can still leak your DNS requests to your ISP, the common causes (IPv6, Windows, browser DoH) and how to test for and fix a DNS leak.How to Change Your DNS ServerChange your DNS server on Windows 11, macOS, Android, iPhone and your router, with the addresses for Cloudflare, Google and Quad9 and the privacy trade-offs.How to Find Out Which DNS Server You Are UsingStep-by-step commands for Windows, Mac, Linux, Android and iPhone to see your DNS server, plus a free test that shows who really answers your lookups.VPN connected but your real IP is still visible: causes and fixesTest shows your real IP while the VPN says connected? Check IPv6, WebRTC, DNS, split tunnelling and a dropped tunnel in order, and how to confirm each.How to Hide Your IP AddressFive practical ways to hide your IP address, from VPNs and Tor to proxies and hotspots: what each protects, what it does not, and how to verify.Are Free VPNs Safe?Why free VPNs are risky, how they make money, documented cases of abuse and what to use instead if you cannot pay. Includes a checklist to evaluate any VPN.

Frequently asked questions

Can my provider see my browsing through a DNS leak?

It can see the site names you look up, not the page contents, which stay encrypted on HTTPS sites.

Is my IP visible during a DNS leak?

Not necessarily. A DNS leak and an IP leak are separate problems, so test both.

Should I use a custom DNS together with a VPN?

Usually let the VPN supply DNS. Setting a different resolver yourself reveals your lookups to that resolver outside the VPN's protection.