DNS in one minute
Every time you open a site, your device must resolve its hostname to an IP address. That query goes to a resolver. Whoever operates that resolver can see the names you looked up — a browsing metadata trail separate from HTTPS encryption of page content.
When a leak happens
- VPN without full-tunnel DNS — OS still uses ISP DNS while IP appears remote.
- Split tunneling — corporate or custom rules send DNS outside the VPN.
- IPv6 ignored — IPv4 inside VPN but IPv6 DNS queries escape locally.
- Manual resolver overrides — router or device hard-coded to Cloudflare/Google while VPN claims privacy.
How to check
Compare the resolver your system uses with what you expect while the VPN is on. Browser-only checks using DNS-over-HTTPS do not fully replicate OS-level DNS — they are useful but not complete. For VPN assurance, use your provider’s leak-test page or compare resolver IP/country with and without the tunnel.
Fixes that work
- Enable “use VPN DNS only” or equivalent in the VPN client.
- Block outbound DNS (port 53) on the router except via VPN — advanced but effective.
- Disable IPv6 temporarily to test, then configure IPv6 leak protection properly.
- On mobile, use the VPN provider’s official app — profiles matter.
FAQ
- Does HTTPS hide my DNS?
- No. HTTPS encrypts page content, not the initial lookup that finds the server.
- Is using 1.1.1.1 a leak?
- Not if you chose it deliberately. It is a leak only when you expected queries to stay inside a VPN or local policy.