Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

VPNs & DNS

Do VPNs Leak DNS?

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:DNS Leak TestWebRTC Leak TestAm I Using a VPN?

A well-built VPN should not leak DNS, but misconfiguration, other software or your operating system can still send lookups outside the tunnel. When that happens, your IP address looks hidden while your internet provider keeps seeing every site name you look up.

Why DNS matters

Before your browser connects to a site, it asks a DNS server for its address. Whoever runs that server sees the name of every site you visit. A VPN is meant to take over DNS as well as traffic. A leak means that handover failed. Read the background in our DNS leak test page.

Common causes

  • IPv6 outside the tunnel. If the VPN covers only IPv4, IPv6 lookups use your normal network. Block or tunnel IPv6.
  • Windows smart multi-homed name resolution. Windows can send a query to all network adapters simultaneously and accept the first reply. Many VPN apps set a firewall rule against this, and manual setups often do not.
  • Browser secure DNS. If Chrome, Edge or Firefox use their own DNS-over-HTTPS provider, lookups bypass the VPN's resolver. They are encrypted but still go to a third party.
  • Router or manual settings. A DNS server set on your router or adapter can override the VPN's.
  • The tunnel dropping. If the VPN disconnects and there is no kill switch, traffic and lookups return to the normal route.
  • Split tunnelling. Apps excluded from the VPN use your normal DNS.

How to test

  1. Connect to your VPN, close other VPN-like software and run the DNS leak test.
  2. If the resolvers belong to your home ISP, or any network that is not the VPN's, you have a leak. A public provider like Google or Cloudflare is not a leak of your location but may not be what you intended.
  3. Test again after disconnecting to see what your normal resolver looks like, to know what a leak would look like.

How to fix it

  1. Enable your VPN app's DNS leak protection, kill switch and IPv6 leak protection options.
  2. Update the VPN app. Leak fixes are common release notes.
  3. Turn off browser-level secure DNS if it overrides the VPN, or set it to use the same provider.
  4. Remove manual DNS settings from your adapter and router while using the VPN.
  5. If you use manual OpenVPN or WireGuard configs, set the DNS option inside the configuration and apply the provider's recommended firewall rules.
  6. Switch providers if the problem persists. A VPN you cannot make leak-free is not doing its job.

Is a leak always bad?

A leak to your ISP defeats a main reason for using a VPN. A leak to a public resolver you chose is a trade-off. Either way, the full privacy scan shows how it affects your overall exposure.

Tools that can help

Privacy-focused DNS

What it does: Change which company answers your website lookups, and can block known malicious or tracking domains. What it does not do: Hide your IP address, stop browser fingerprinting, or hide which sites you visit from your internet provider (it can still see the connection).

  • Quad9FreeNo commissionFree public resolver run by a non-profit that blocks known malicious domains. Visit site
  • Cloudflare 1.1.1.1FreeNo commissionFree public resolver focused on speed, with optional malware-blocking addresses. Visit site

We list free and built-in options first. How we choose.

Keep reading

How to Change Your DNS ServerChange your DNS server on Windows 11, macOS, Android, iPhone and your router, with the addresses for Cloudflare, Google and Quad9 and the privacy trade-offs.IPv4 vs IPv6IPv4 vs IPv6 explained: address formats, why we need IPv6, how dual stack works and why a VPN that ignores IPv6 can reveal your real location.VPN vs Proxy vs TorVPN vs proxy vs Tor compared: what each hides, who can still see your traffic, speed, cost and which to choose for streaming, privacy or anonymity.DNS requests bypassing your VPN: how to find and fix themA DNS leak sends your lookups to your ISP even with a VPN on. Why it happens on Windows, macOS, Android and iPhone, and how to fix it.How to Check If Your VPN Is Leaking Your IP AddressA five-minute checklist to test your VPN for IP, DNS, WebRTC and IPv6 leaks, and what to do if any test fails. Free tools, no sign-up.How to Find Out Which DNS Server You Are UsingStep-by-step commands for Windows, Mac, Linux, Android and iPhone to see your DNS server, plus a free test that shows who really answers your lookups.How to Test Your VPN Kill SwitchA kill switch should cut your internet when the VPN drops. Here is a simple, safe way to test it with a repeating IP check, on Windows, Mac and Linux.What Is an IPv6 Leak, and How Do You Fix It?An IPv6 leak exposes your real address even while a VPN shows connected. Learn how it happens, how to test for it and three ways to fix it.

Frequently asked questions

Does a VPN encrypt DNS?

Properly configured, yes: lookups travel inside the tunnel to the VPN's own resolvers. That is the part that can fail, which is why testing matters.

Does a DNS leak reveal my IP address?

Not directly, but it reveals which sites you visit to whoever runs the leaking resolver, usually your ISP, which already knows your IP.