How to Check for a DNS Leak

Step 1: Understand what a DNS leak is

When you use a VPN, DNS queries should be handled by the VPN provider's DNS server inside the encrypted tunnel. A DNS leak happens when queries bypass the tunnel and go to your ISP or another DNS provider instead. Your ISP can then see which domains you are looking up — defeating the privacy benefit of the VPN for that data.

Step 2: Run a DNS leak test

Visit SpeedTestHQ DNS Leak Test while connected to your VPN. The test shows which DNS servers are resolving your queries. If you see your VPN provider's DNS servers: no leak. If you see your ISP's DNS servers or a different provider: you have a leak. Run the test both with and without VPN to compare.

Step 3: Fix DNS leaks in your VPN client

In your VPN application settings, look for DNS leak protection or Private DNS settings. Enable it. Most reputable VPN clients (Mullvad, ProtonVPN, ExpressVPN) include DNS leak protection by default — check that it is not disabled. If your VPN app does not have this setting, consider switching to one that does.

Step 4: Configure OS DNS to prevent leaks

On Windows: open Network Connections, find your non-VPN adapter, and set DNS to a non-ISP resolver (1.1.1.1 / 8.8.8.8). This prevents Windows from using the ISP DNS as a fallback when the VPN DNS is slow. On macOS: set DNS in System Settings > Network for each adapter. This reduces the chance of the OS falling back to ISP DNS.

Step 5: Check for WebRTC leaks

WebRTC is a browser technology that can expose your real IP address even when connected to a VPN. Test for WebRTC leaks using a browser-based WebRTC leak test. If your real IP is visible: disable WebRTC in your browser. In Firefox: type 'about:config', search 'media.peerconnection.enabled', set to false. In Chrome: use an extension like uBlock Origin which can block WebRTC.

Step 6: Use a VPN with its own DNS

The most reliable protection against DNS leaks is a VPN that runs its own DNS servers and routes all DNS through the tunnel by default. Mullvad, ProtonVPN, and IVPN all operate their own DNS infrastructure. Avoid VPNs that forward DNS to third-party resolvers (Google DNS, etc.) as this introduces additional points of potential leakage.

Frequently Asked Questions

Can a DNS leak reveal my location?

DNS servers see the IP making the query — if your ISP's DNS server receives the query, they see your real IP. This reveals your ISP and approximate location (ISP's region), not your precise address. The more significant risk is the domain-level browsing history being logged.

Does using a private browser prevent DNS leaks?

No — DNS queries are an OS-level operation. A private browsing window uses the same DNS configuration as regular browsing. The fix is at the VPN or OS level, not the browser level.

Is a DNS leak the same as a VPN not working?

A DNS leak is a partial VPN failure — your connection traffic is still tunneled and encrypted, but DNS queries leak outside the tunnel. From a privacy perspective, it is a significant gap because DNS queries reveal all the domains you visit.