What Is a DNS Leak and How Do You Test for It?

Also on CyberFence: the free CyberFence security tools · run a free DNS leak test .

A DNS leak is the single most common way a VPN silently fails to do the one thing people buy it for: hiding which sites you visit from your internet provider. Your VPN can be connected, showing a green checkmark, encrypting your traffic, and hiding your IP address from every website you visit — while your ISP still sees, in plain text, every single domain you look up. That is a DNS leak, and most people who have one never find out unless they specifically test for it.

What DNS actually does

Every time you type a website address or tap a link, your device needs to convert that human-readable domain (cyberfenceplatform.com) into a numeric IP address the network can actually route to. That lookup is called a DNS query, and it happens dozens of times per browsing session — for the page itself, and for every image, script, and ad it loads.

Normally, that DNS query goes to whichever DNS resolver your device is configured to use. On an unprotected connection, that is almost always your ISP's own DNS servers. Your ISP does not need to see the content of your traffic to build a detailed profile of your browsing — the list of domains you query is often just as revealing on its own.

What a DNS leak actually is

When you connect to a VPN, the VPN app is supposed to redirect all of your device's DNS queries through its own encrypted tunnel to its own DNS resolver. A DNS leak happens when some or all of your DNS queries bypass that tunnel and go directly to your ISP's DNS servers instead — even though the rest of your traffic is correctly routed through the VPN.

The practical effect: your IP address is hidden from the websites you visit (the VPN is doing that part correctly), but your ISP can still see the exact list of every domain you looked up, in order, in real time. For someone using a VPN specifically to keep their ISP from tracking or monetizing their browsing habits, a DNS leak defeats the entire purpose without any visible warning sign.

What causes a DNS leak

1. IPv6 DNS requests bypassing an IPv4-only VPN tunnel

Many VPN apps only tunnel IPv4 traffic. If your network also supports IPv6 (increasingly common with modern ISPs and mobile carriers), your operating system may send IPv6 DNS queries outside the tunnel entirely, straight to your ISP, even while your IPv4 traffic is fully protected.

2. Operating system DNS caching and "smart" multi-homed resolution

Windows in particular has a feature that queries multiple DNS resolvers simultaneously and uses whichever responds first — a performance feature that predates VPNs being common and doesn't understand that one of those resolvers should be the only one used. This is one of the most frequently cited causes of DNS leaks on Windows specifically.

3. Poorly configured VPN clients (or none at all — using manual protocol setup)

If you configure a VPN protocol manually (rather than using the provider's dedicated app), it is easy to correctly route IP traffic through the tunnel while forgetting to also force DNS through it. This is a common mistake with manual OpenVPN or WireGuard configuration, and it is one of the strongest reasons to use a provider's official app rather than a manual config.

4. Router-level or transparent DNS proxying by the ISP

Some ISPs intercept all outbound DNS traffic at the router or network level, redirecting it to their own resolvers regardless of what DNS server your device thinks it's using. This is harder to detect and can leak DNS even when your VPN app is configured correctly, unless the VPN also encrypts the DNS query itself (not just routes it) so the ISP cannot read or redirect it.

How to test for a DNS leak

Testing takes about thirty seconds:

1. Connect to your VPN and confirm it shows as active.
2. Visit CyberFence's DNS leak test tool.
3. Look at the list of DNS servers the test detects. If any of them belong to your home ISP (rather than your VPN provider), you have a DNS leak.
4. Also check the IP address shown. If it matches your VPN server's location, the IP side is working correctly even if DNS is leaking — they are two separate protections that can fail independently.

Run this test any time you switch VPN protocols, update your VPN app, switch networks (home to mobile hotspot, for example), or notice unusual VPN behavior. It is worth running once after initial setup and then periodically, not just once ever.

How to fix a DNS leak

Use a VPN app with dedicated, built-in DNS leak protection

The single most reliable fix is using a VPN provider that runs its own DNS resolver and forces 100 percent of DNS traffic — IPv4 and IPv6 — through the encrypted tunnel by default, with no manual configuration required. CyberFence's Web Shield handles this automatically: every DNS query from every app on the device routes through CyberFence's own resolver inside the tunnel, and IPv6 traffic is either tunneled or blocked outright rather than allowed to leak.

Disable IPv6 if your VPN doesn't fully support it

If you are using a VPN that doesn't have confirmed IPv6 DNS protection, disabling IPv6 entirely on your device (in network adapter settings) closes that specific leak vector. This is a workaround, not a permanent fix — the better fix is a VPN that handles IPv6 correctly in the first place.

Turn off "smart multi-homed name resolution" on Windows

On Windows 10 and 11, this can be disabled via Group Policy Editor (Computer Configuration → Administrative Templates → Network → DNS Client → Turn off smart multi-homed name resolution → Enabled) or through a registry edit. Most reputable VPN apps for Windows handle this automatically now, but it's worth confirming if you're using a manual configuration.

Use the VPN provider's official app, not a manual protocol configuration

Official apps are built and tested specifically to prevent DNS leaks across IPv4, IPv6, and OS-level quirks like the Windows issue above. Manual configurations put that burden on you.

Enable a kill switch

A kill switch doesn't directly prevent DNS leaks, but it closes a related gap: if your VPN connection drops for any reason, a kill switch stops all traffic (DNS included) rather than silently falling back to your unprotected connection and ISP DNS.

Why this matters more than most VPN buyers realize

Marketing for VPN products focuses heavily on IP-address masking because it's the easiest concept to explain. DNS leak protection gets far less attention despite being at least as important for the privacy use case most people actually care about: keeping their ISP from building a detailed browsing profile. An ISP with your DNS query log can reconstruct most of your browsing history even if it never sees the actual page content, because the domain list alone (which banking site, which health site, which streaming service, which specific competitor's product page) is highly revealing on its own.

When evaluating any VPN, ask specifically whether DNS leak protection is built in by default or requires manual configuration, and whether it covers both IPv4 and IPv6. If a provider's marketing only talks about IP masking and encryption without mentioning DNS handling at all, that's worth asking about directly before you buy.

Bottom line

A DNS leak means your VPN is hiding your IP address while your ISP can still see every domain you visit in plain text — silently defeating the privacy purpose most people buy a VPN for. It's most often caused by IPv6 traffic bypassing an IPv4-only tunnel, Windows's smart multi-homed name resolution feature, or manual VPN configurations that forget to force DNS through the tunnel. Test for it in thirty seconds with a free DNS leak test tool, and fix it permanently by using a VPN app with dedicated, automatic DNS leak protection rather than relying on manual configuration or hoping your provider handles it by default.

Want to go deeper? Read our free privacy and security tools , the CyberFence DNS leak test , or the CyberFence WebRTC leak checker .