You switched on your VPN to keep your browsing private, but a DNS leak test still shows your internet provider’s servers. That means every website name you visit is being sent outside the encrypted tunnel, where your provider – or the operator of a public Wi-Fi network – can log it. The good news: DNS leaks are usually easy to fix. This guide covers the causes and step-by-step fixes for every major platform.
Quick recap: what DNS leaks reveal
Before your device connects to a website, it asks a DNS resolver to translate the name (such as example.com) into an IP address. The resolver sees every name you look up. A VPN should send those DNS questions through its tunnel to its own resolvers. A leak happens when they go to your internet provider instead. Your traffic itself is still encrypted, but your browsing history is not.
Step 1: Confirm the leak
- With the VPN off, run a DNS leak test and note the resolvers – usually your provider.
- Connect the VPN and run the test again.
- If your provider’s resolvers still appear, or resolvers located in your real country appear while the VPN server is abroad, you have a leak.
Seeing Cloudflare, Google or Quad9 is not automatically a leak – your VPN may use them, or your browser may be using Secure DNS. Focus on whether your own provider appears.
Step 2: Fix it in the VPN app
Most leaks are fixed by the VPN’s own settings. Look for options named:
- DNS leak protection or Use VPN DNS only – turn on.
- Kill switch or Block connections without VPN – turn on, so nothing escapes if the tunnel drops.
- IPv6 leak protection or Block IPv6 – turn on if the VPN does not fully support IPv6.
- Custom DNS – leave empty unless you know you need it; custom servers can bypass the VPN’s resolvers.
- Split tunnelling – make sure your browser is not excluded from the VPN.
Also update the VPN app – older versions and manually configured OpenVPN profiles are common sources of leaks. If you set up WireGuard or OpenVPN by hand, make sure the configuration includes a DNS server (for WireGuard, a DNS = line in the [Interface] section).
Step 3: Platform-specific fixes
Windows 10 and 11
Windows has a feature called Smart Multi-Homed Name Resolution that sends DNS queries to all network adapters at once and uses the fastest answer – which can be your provider’s resolver outside the VPN.
- Windows Pro, Enterprise or Education: press Win + R, run
gpedit.msc, go to Computer Configuration › Administrative Templates › Network › DNS Client, open Turn off smart multi-homed name resolution, set it to Enabled, and restart. - Windows Home: use a VPN app that blocks DNS outside the tunnel (most major apps do this when DNS leak protection is on).
Also check that your Wi-Fi or Ethernet adapter is not set to a fixed DNS server: Settings › Network & internet › your connection › DNS server assignment should be Automatic (DHCP) while you use the VPN, so the VPN can take over. Finally, flush the cache with ipconfig /flushdns in Command Prompt.
macOS
- Open System Settings › Network › Wi-Fi › Details › DNS and remove any manually added DNS servers, or make sure the VPN service is ordered above Wi-Fi in Network › … › Set Service Order.
- Check for configuration profiles or “DNS” apps that install encrypted DNS settings system-wide (System Settings › Privacy & Security › Profiles, or a “DNS” section under Network). These can bypass the VPN.
- Flush the cache in Terminal:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
Android
- Private DNS (Settings › Network & internet › Private DNS, location varies by brand) sends DNS to a chosen provider over TLS. If set to a specific hostname, it can bypass your VPN’s resolvers. Set it to Automatic or Off while using the VPN, unless the VPN recommends otherwise.
- Enable Always-on VPN and Block connections without VPN in Settings › Network & internet › VPN › gear icon.
iPhone and iPad
- Check Settings › General › VPN & Device Management for DNS profiles or apps that configure encrypted DNS; remove or disable them while using the VPN.
- If you use iCloud Private Relay, be aware that it handles DNS for Safari separately; turn it off while testing a VPN (Settings › [your name] › iCloud › Private Relay).
- In the VPN app, enable any “Connect on demand” and kill-switch options.
Linux
On systems with systemd-resolved, run resolvectl status to see which DNS servers each interface uses. The VPN interface should have its DNS servers and a routing domain of ~. so all queries go through it. NetworkManager VPN connections usually handle this automatically; for manual WireGuard setups, the DNS = line and resolvconf or systemd-resolved integration are needed.
Step 4: Check your browser’s Secure DNS
Chrome, Edge, Firefox and Brave can use DNS over HTTPS (DoH), which sends DNS directly to a provider such as Cloudflare or Google from inside the browser, ignoring the operating system’s DNS – and the VPN’s. This is encrypted, so your internet provider cannot read it, but it is a different resolver from your VPN’s.
- Chrome / Edge / Brave: Settings › Privacy and security › Security › Use secure DNS.
- Firefox: Settings › Privacy & Security › DNS over HTTPS.
Either turn it off while using the VPN, or set it to a provider you trust. Both are valid choices; just make it a deliberate one.
Step 5: Check your router
If your VPN runs on the router itself, make sure the router’s DHCP hands out the VPN’s DNS servers (or the router’s own address, with the router forwarding DNS through the tunnel). Some routers have a “DNS rebind” or “DNS redirect” setting that forces all DNS to the provider – disable it for VPN use.
Step 6: Retest
Reconnect the VPN, restart the browser and run the DNS leak test again. You should only see resolvers belonging to your VPN provider (or the public resolver it uses). Finish with the WebRTC leak test and VPN check to make sure nothing else is leaking.
Still leaking?
Try a different VPN protocol (WireGuard or OpenVPN instead of IKEv2, or vice versa), disable other network adapters you are not using, and contact your VPN’s support with the test results. A reputable VPN should be able to give you a configuration that does not leak.