A DNS leak is a privacy vulnerability that occurs when your DNS queries β the lookups that translate domain names like google.com into IP addresses β travel outside your encrypted tunnel and reach your ISP's servers instead. Even with a VPN active, your internet provider can see every website you visit if you have a DNS leak. You can check your DNS security right now on whatsmy.fyi.
What Is DNS?
DNS (Domain Name System) is the internet's phonebook. Every time you type a website address into your browser, your device sends a DNS query asking "what is the IP address of this domain?" A DNS resolver β typically operated by your ISP β looks up the answer and returns the IP so your browser can connect.
By default, this lookup is sent in plain text over UDP port 53. Your ISP can log every single DNS query, building a detailed record of your browsing habits without ever seeing the content of your traffic.
What Is a DNS Leak?
When you use a VPN, all your internet traffic β including DNS queries β is supposed to travel through the encrypted VPN tunnel and exit through the VPN provider's servers. A DNS leak happens when your device bypasses this tunnel for DNS queries and sends them directly to your ISP's DNS resolver.
The result: your VPN hides your IP address and encrypts your browsing data, but your ISP still receives a complete log of every domain name you visit. The encrypted tunnel is protecting your traffic, but the DNS requests are leaking outside it.
Why Do DNS Leaks Happen?
DNS leaks are not intentional β they arise from misconfigurations and how operating systems handle network transitions:
- Split tunnel DNS: Some VPN clients use split tunneling to route only certain traffic through the VPN. If DNS is not explicitly included in the tunnel, queries go through the default interface.
- OS-level DNS fallback: Windows, in particular, has a feature called "smart multi-homed name resolution" that sends DNS queries to all available network interfaces simultaneously and uses whichever responds first β often the local ISP.
- IPv6 DNS leaks: Many VPNs only tunnel IPv4 traffic. If your device has an IPv6 connection, DNS queries may travel over the unprotected IPv6 interface.
- DHCP DNS override: When connecting to a network, DHCP assigns a DNS server. If your device accepts this assignment instead of using the VPN's DNS, queries leak to that server.
How to Test for a DNS Leak
The DNS Security card on whatsmy.fyi checks whether your network allows DNS over HTTPS and whether your connection routes traffic through a known VPN provider. If you are using a VPN, the card confirms that your DNS queries are encrypted through the tunnel.
For a definitive DNS leak test, dedicated tools use a technique involving custom authoritative nameservers. They assign you a unique subdomain (e.g., abc123.test.dnsleak.com), trigger a DNS lookup for that subdomain from your browser, and then check which DNS server actually resolved the query. If it was your ISP's resolver instead of your VPN's resolver, you have a DNS leak.
How to Fix a DNS Leak
Option 1: Use a VPN with Built-in DNS Leak Protection
Most reputable VPN providers include DNS leak protection as a feature. This forces all DNS queries through the VPN tunnel and prevents the OS from using any other resolver. Look for this setting in your VPN client and make sure it is enabled.
Option 2: Configure a Privacy-Focused DNS Resolver
Switching your DNS resolver to a provider that does not log queries dramatically reduces your exposure. Well-known options:
- Cloudflare 1.1.1.1 β Fast, privacy-first, no query logging. Supports DNS over HTTPS and DNS over TLS.
- Google 8.8.8.8 β Widely used, reliable. Some query logging for security and abuse prevention.
- Quad9 9.9.9.9 β Privacy-focused with built-in malware blocking. Non-profit operated.
- NextDNS β Fully configurable with detailed query logs you control.
Option 3: Enable DNS over HTTPS (DoH)
DNS over HTTPS encrypts DNS queries by wrapping them in HTTPS. Unlike traditional DNS which sends plain-text queries over UDP, DoH sends queries to a web server using the same encrypted protocol used for websites. Your ISP sees HTTPS traffic to a DoH provider β not the individual domain names you are resolving.
Modern browsers have built-in DoH support:
- Firefox: Settings β Privacy & Security β DNS over HTTPS. Select "Max Protection" to block all non-DoH queries.
- Chrome / Edge: Settings β Privacy and security β Security β Use secure DNS. Enable and choose a provider.
- OS-level (Windows 11, macOS 13+): Both support DoH at the operating system level, protecting all apps β not just the browser.
DNS Leak vs WebRTC Leak
DNS leaks and WebRTC leaks are separate issues but both can expose your real identity while using a VPN. A WebRTC leak exposes your real IP address directly; a DNS leak exposes the websites you visit. You should test for both. whatsmy.fyi checks both on the same page.
Does DNS over HTTPS Solve Everything?
DoH prevents your ISP from reading your DNS queries in transit, but it does not make you anonymous. The DoH provider still receives your DNS queries. Cloudflare 1.1.1.1 and Quad9 have published strong no-logging policies, but you are shifting trust from your ISP to the DoH provider. For maximum privacy, combine DoH with a VPN.
Additionally, DoH does not hide the fact that you are connecting to a particular IP address β only the initial name resolution step. Network metadata analysis can still reveal which services you use even with DoH enabled.
Frequently Asked Questions
Can I have a DNS leak without using a VPN?
Technically no β a "leak" implies traffic bypassing an expected secure channel. Without a VPN, all your DNS queries go to your ISP by default; this is normal operation. The risk is that your ISP logs and potentially monetises this data. The solution is to switch to a privacy-respecting DNS resolver or enable DNS over HTTPS.
Does a DNS leak expose my passwords or browsing content?
No. DNS leaks only expose the domain names you visit (e.g., google.com), not the content of your connections. Your passwords, messages, and page content are still protected by TLS encryption. However, the list of domains you visit is considered sensitive metadata in most privacy frameworks.
Will switching to 1.1.1.1 speed up my internet?
Often yes. DNS resolution speed affects how quickly your browser can start loading a page after you type an address. Cloudflare 1.1.1.1 consistently ranks as the fastest public DNS resolver in independent benchmarks. Faster DNS resolution reduces perceived latency β you can see your current DNS resolution time reflected in the latency on your connection.
