What is a DNS leak? How to test and fix it

A DNS leak happens when your device sends website lookup requests outside the encrypted VPN tunnel, usually to your internet provider or another DNS resolver. That can reveal the domain names you visit, even if the VPN is still hiding your IP address from the website itself.

The good news is that DNS leaks are testable and usually fixable. This guide explains what DNS is, why DNS requests are sensitive, the common causes of a DNS leak, how to run a reliable DNS leak test, and how to reduce the risk on desktop, mobile, and browsers.

What is DNS and why does it matter?

DNS stands for Domain Name System. It is the internet’s address book. When you type a site name into your browser, your device needs to find the server address for that name before it can load the page.

For example, you remember a domain name because it is human readable. Your browser and apps need an IP address because networks route traffic using numbers. DNS is the system that turns the name into the address.

A normal DNS lookup is simple in principle:

1. You type a domain name or open an app.
2. Your device asks a DNS resolver where that domain points.
3. The resolver replies with the IP address or related records.
4. Your device connects to the destination and loads the service.

The important privacy point is that DNS requests can reveal intent. A DNS resolver may not see the full page URL, the exact article, or the contents of an encrypted HTTPS session. But it can often see the domain name you asked for, such as a news site, a bank, a health forum, a workplace tool, or a streaming service.

That is why DNS handling is part of VPN privacy. A VPN is not only about changing the IP address visible to websites. It should also prevent routine lookup traffic from slipping outside the protected path. If you are new to VPN basics, see what is a VPN for a broader explanation of how VPN tunnels work.

What is a DNS leak?

A DNS leak is a mismatch between where your main internet traffic goes and where your DNS queries go. Your web traffic may be routed through a VPN server, while DNS lookups still go to your ISP, your mobile carrier, a public resolver configured on the device, or a resolver chosen by your browser.

That creates a privacy gap. The site you visit may see the VPN server’s IP address, but the DNS resolver outside the tunnel may still see the domains you request. If that resolver belongs to your ISP, your ISP may be able to infer much of your browsing activity from DNS metadata.

A DNS leak does not necessarily mean your entire VPN has failed. It can happen while the VPN icon says connected and while your public IP address appears to be the VPN server. That is what makes DNS leaks easy to miss unless you test for them directly.

With Crispy VPN, DNS requests are routed through the VPN tunnel when the app is connected. That design keeps DNS lookup traffic aligned with the VPN connection instead of letting it fall back to the network you are using.

What a DNS leak can reveal

• Domain names: the sites and services your device asks to resolve.
• Timing: when those requests happen.
• Network context: the fact that the request came from your home ISP, workplace, hotel, mobile carrier, or another local network.

DNS alone usually does not expose the full contents of a secure HTTPS page. It also does not make you anonymous. Websites you log into can still recognize your account, and trackers may still use cookies or browser fingerprints. But DNS leaks are still worth preventing because they expose a useful map of what you access.

How does a DNS leak happen?

DNS leaks usually come from configuration conflicts. Modern operating systems, browsers, VPN apps, and network adapters can all influence DNS behavior. If those layers disagree, lookups may take a path you did not expect.

Operating system DNS settings

Your operating system decides which DNS servers to use for each network interface. When a VPN connects, it normally adds a virtual network interface and should push DNS traffic through that interface. A leak can happen if the OS keeps using the old Wi-Fi or Ethernet DNS server instead.

This is more likely after repeated network changes, sleep and wake cycles, captive portal logins, or manual network tweaks. Restarting the VPN connection often clears a temporary routing problem, but persistent leaks need a settings review.

IPv6 handling

IPv6 is a newer internet addressing system that can run alongside IPv4. DNS can resolve both IPv4 and IPv6 records. If a VPN or device routes IPv4 traffic correctly but lets IPv6 DNS or IPv6 traffic use the local network, that can create a leak.

This is why testing should check the whole connection, not just whether one visible IPv4 address changed. A clean result means your DNS servers and visible IP information match the VPN route you intended to use.

Manual DNS servers

Many people set custom DNS servers on a device, router, or browser to improve speed, filtering, or reliability. Those settings can override the DNS servers supplied by a VPN app. If the custom resolver is reached outside the tunnel, you have a DNS leak.

Manual DNS is not always bad, but it needs to be compatible with your privacy goal. When using a VPN, the safest default is to let the VPN app manage DNS unless you have a specific reason and you know where those queries are going.

Browser DNS over HTTPS

Some browsers offer DNS over HTTPS, often called secure DNS. It encrypts DNS between the browser and a DNS provider. That can protect DNS from the local network, but it can also bypass the DNS settings used by your VPN app.

If browser DNS over HTTPS is set to a resolver outside the VPN path, a leak test may show that resolver instead of the VPN DNS. It may be encrypted, but it is still not using the VPN’s intended DNS handling. Browser extensions can also have their own routing rules, so browser testing and full device testing may differ.

Split tunneling choices

Split tunneling lets selected apps or websites use a different route from the rest of your traffic. It is useful when you want some traffic inside the VPN and some traffic outside it. But it can also explain surprising DNS results.

If an app or website is excluded from the VPN, its DNS may also be excluded, depending on the platform and implementation. Crispy VPN supports split tunneling on Android by app, on iPhone and iPad by website, and in browser extensions by website. If you use split tunneling, review your rules before assuming every DNS request is protected. For a deeper guide, read what is split tunneling.

How to run a DNS leak test

A DNS leak test checks which DNS resolvers can see your lookup requests. The basic idea is to compare what appears with the VPN off and with the VPN on. If the same ISP or local network DNS servers appear while the VPN is connected, you likely have a leak.

Run the test in the same conditions you actually use. If you browse mostly in a specific browser, test there. If you use a desktop app or mobile app, test the whole device connection too. If you often switch between Wi-Fi and mobile data, test both networks.

DNS leak test checklist

1. Disconnect the VPN. Visit a DNS leak test page and note the DNS provider names, countries, and IP addresses shown. This is your baseline.
2. Connect the VPN. Choose the VPN server location you normally use and wait until the app reports connected.
3. Refresh the test page. Run the standard test first. If an extended test is available, run that too.
4. Compare the results. You should not see your ISP, workplace, school, hotel, or mobile carrier DNS servers when the VPN is connected.
5. Check your visible IP. Use an IP check page to confirm your public IP has also changed to the VPN location. You can use what is my IP for this part.
6. Repeat after switching networks. Test again after changing Wi-Fi networks, moving to mobile data, or waking the device from sleep.

A good result is not always labeled with your VPN brand. DNS infrastructure can use different provider names, data center names, or relay addresses. What matters is that the result does not show your local ISP or another resolver you did not intend to use.

If you use Crispy VPN, connect the app first, then run the test. DNS should be routed through the tunnel along with your VPN traffic. If you see your ISP DNS after connecting, treat it as a device or browser configuration issue and work through the fixes below.

How to fix DNS leak problems

The right fix depends on the cause. Start with the least invasive steps, then move to platform and browser settings if the leak remains.

Quick fixes to try first

1. Disconnect and reconnect the VPN. This refreshes routes and DNS settings.
2. Switch VPN server locations. A new connection can clear stale network state.
3. Restart the app and browser. Browsers may cache DNS decisions until they restart.
4. Restart the device. This resets network interfaces and old DNS assignments.
5. Update the VPN app and operating system. DNS routing bugs are often fixed through updates.

Check manual DNS settings

Look at your Wi-Fi, Ethernet, and mobile network settings. If you manually added DNS servers, remove them temporarily and set DNS back to automatic. Then reconnect the VPN and run the DNS leak test again.

If the leak disappears, the manual DNS setting was overriding the VPN. You can decide whether that custom DNS is worth keeping, but do not assume it is private just because it is familiar or encrypted.

Review browser secure DNS

Open your browser privacy or security settings and look for secure DNS or DNS over HTTPS. If it is enabled with a specific provider, turn it off temporarily or set the browser to use the operating system default. Reconnect the VPN, restart the browser, and test again.

This is especially important if only one browser leaks while other apps test cleanly. In that case, the VPN may be working correctly at the system level while the browser is choosing its own resolver.

Review split tunneling rules

If split tunneling is enabled, check whether the browser, test site, or app is excluded from the VPN. Remove the exclusion and run the test again. A result that changes after disabling split tunneling is not mysterious. It means the rule was doing what it was configured to do.

Use the VPN app instead of unsupported workarounds

Unsupported router setups, random configuration files, or third party network tools can make DNS routing harder to predict. Crispy VPN provides apps for iPhone and iPad, Mac, Windows, Linux, Android, Apple TV, Android TV and Google TV, plus browser extensions for Chrome, Edge, and Firefox. Download the correct app from the download page and test from there.

On supported devices, Crispy VPN uses WireGuard on every server. WireGuard is a modern VPN protocol with a small code base, strong performance, and good battery behavior on mobile devices. If you want the protocol background, see what is WireGuard.

DNS leak prevention on different devices

DNS leak prevention is mostly about keeping the VPN app in control of routing and avoiding conflicting DNS settings. The details vary by device.

Windows, Mac, and Linux

Desktop systems often have multiple network interfaces: Wi-Fi, Ethernet, virtual adapters, and sometimes work profiles. If a DNS leak appears, check adapter DNS settings and remove old manual resolvers. Then reconnect the VPN.

On Windows, Mac, and Linux, a kill switch can also help reduce exposure if the VPN connection drops. Crispy VPN includes an opt-in kill switch on these desktop platforms. On Windows, there is also an optional Lockdown mode. A kill switch is not the same as DNS leak protection, but it helps prevent traffic from continuing outside the VPN during connection interruptions.

iPhone, iPad, and Android

Mobile devices move between Wi-Fi, mobile data, hotel networks, and captive portals. Test after network changes if you rely on the VPN for privacy. Also check whether private DNS, device management profiles, or security apps are changing DNS behavior.

On Android, the system settings called Always-on VPN and Block connections without VPN can help prevent accidental traffic outside the VPN. On iPhone and iPad, keep the VPN app updated and review any website split tunneling rules if a specific site behaves unexpectedly.

Browsers and extensions

Browsers are a common source of confusing DNS results because they can use their own secure DNS setting. If a leak appears only inside Chrome, Edge, or Firefox, check browser DNS settings before changing the entire device.

Browser extensions also cover browser traffic rather than every app on the device. That is useful when you only need protection for web browsing, but it is not the same as a full device VPN connection. For more on that distinction, read VPN browser extension.

TV devices

TV platforms are simpler, but they also expose fewer network controls. Crispy VPN supports Apple TV and Android TV or Google TV, with sign-in by scanning a QR code with your phone. If you are troubleshooting DNS on a TV, test the same network from a phone or laptop first, then reconnect the TV app.

What a VPN can and cannot hide from DNS

A well configured VPN should keep DNS requests inside the encrypted tunnel. That prevents the local Wi-Fi operator, ISP, or mobile carrier from seeing ordinary DNS lookups in the clear. It also keeps your DNS path consistent with the VPN server you selected.

Crispy VPN also has a no activity logs policy and uses a two-party relay design that separates who you are from what you do. That is relevant because DNS privacy is not only about the tunnel. It is also about how the service is built to reduce unnecessary linkage.

Still, a VPN does not make you anonymous. It does not stop malware or phishing by itself, and it does not stop a site from recognizing you when you log into your account. It also cannot erase tracking cookies already stored in your browser.

Think of DNS leak protection as one layer. It helps keep website lookup metadata away from the local network and ISP. Combine it with sensible browser settings, cautious account use, regular updates, and a clear understanding of what the VPN is protecting.

If you are checking your setup after installing a VPN, it is worth testing more than DNS. Public IP, WebRTC behavior, kill switch settings, and browser configuration can all affect privacy. A practical next step is is my VPN working, which walks through the broader checks.