Skip to content
speedtest.doctor
Privacy

What Is a DNS Leak? A Plain-Language Guide

The speedtest.doctor team 8 min read

A DNS leak means your device asks a DNS resolver outside the tunnel or privacy path you expect — often your ISP — so domain names you visit can still be logged. VPN users care most, but anyone switching resolvers for speed or parental controls should understand the trade-off.

DNS in one minute

Every time you open a site, your device must resolve its hostname to an IP address. That query goes to a resolver. Whoever operates that resolver can see the names you looked up — a browsing metadata trail separate from HTTPS encryption of page content.

When a leak happens

  • VPN without full-tunnel DNS — OS still uses ISP DNS while IP appears remote.
  • Split tunneling — corporate or custom rules send DNS outside the VPN.
  • IPv6 ignored — IPv4 inside VPN but IPv6 DNS queries escape locally.
  • Manual resolver overrides — router or device hard-coded to Cloudflare/Google while VPN claims privacy.

How to check

Compare the resolver your system uses with what you expect while the VPN is on. Browser-only checks using DNS-over-HTTPS do not fully replicate OS-level DNS — they are useful but not complete. For VPN assurance, use your provider’s leak-test page or compare resolver IP/country with and without the tunnel.

Fixes that work

  1. Enable “use VPN DNS only” or equivalent in the VPN client.
  2. Block outbound DNS (port 53) on the router except via VPN — advanced but effective.
  3. Disable IPv6 temporarily to test, then configure IPv6 leak protection properly.
  4. On mobile, use the VPN provider’s official app — profiles matter.

FAQ

Does HTTPS hide my DNS?
No. HTTPS encrypts page content, not the initial lookup that finds the server.
Is using 1.1.1.1 a leak?
Not if you chose it deliberately. It is a leak only when you expected queries to stay inside a VPN or local policy.