Explainer
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
Before your device can reach a site, it asks a DNS server for the site's address. With a VPN on, that question should travel through the tunnel. A DNS leak is what happens when it does not: your traffic is sealed, but your network is told the name of every site you visit, in order.
The VPN can look completely healthy throughout, and the client will still show that it is connected.
DNS is handled by its own setting on most systems, separately from the route your traffic takes. There are several ways the two can part company.
| Where lookups go | Who sees the site names |
|---|---|
| Through the tunnel, to the provider's own server | The VPN provider |
| Through the tunnel, to a third-party server | The VPN provider, if the lookup is unencrypted, and that third party |
| Outside the tunnel, to your network's server | Your internet provider, and possibly others on the network |
| Outside the tunnel, unencrypted, to another server | That server, and anyone able to read your network |
So fixing a leak does not make your lookups private. It decides who gets them, which is why it matters whether a provider runs its own DNS inside the tunnel, and what that provider keeps.
One clean result covers that moment on that device. It is worth repeating after a system or client update.
Start with the client's own settings: many have a DNS leak protection option, so check it is on. Remove any custom DNS you set on the device unless you meant to keep it, and check your browser's secure DNS setting. If the client cannot keep lookups inside the tunnel after that, the provider has not solved a basic part of the job.
A leak is a fault in the setup, separate from the larger question of who you trust. This site reads what providers publish and does not test clients for leaks, so run the check yourself. What a VPN is shows where this step fits.
With the VPN connected, open a DNS leak test page and look at which servers answered. If they belong to your VPN provider, or to a service it says it uses, that looks right. If they belong to your internet provider, your lookups are leaving outside the tunnel.
It exposes which sites you reach and when, not what you do there. That can still say a great deal: a list of site names in order describes much of your day.
No. It hides your lookups from your network, but the addresses you connect to are still visible, and other parts of a connection can reveal the site's name. It solves one part of the problem, and the resolver you choose then sees your lookups.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.