What Is a DNS Leak? How to Test and Fix VPN Leaks

What is a DNS leak?

DNS (the Domain Name System) turns names like example.com into the IP addresses computers connect to. Before a page or app loads, your device asks a DNS resolver, usually one run by your internet provider or handed out by the router. Traditional DNS queries travel unencrypted on port 53, so the resolver's operator and anyone on the network path, such as whoever runs a hotel hotspot, can see which names you look up.

When a VPN connects, its client should point DNS at a resolver reached through the tunnel. A DNS leak happens when lookups keep going to the old resolver outside the tunnel instead. Pages still load through the VPN, but a list of the domains you visit ends up with your provider or the local network anyway.

Three other leaks are worth testing for:

Why DNS leaks happen with a VPN

A leak rarely means the VPN's encryption is broken. Usually some traffic never entered the tunnel in the first place. The common reasons:

• Windows queries more than one adapter. Smart Multi-Homed Name Resolution, present since Windows 8, can send a DNS query through several network interfaces in parallel. Unless the VPN client limits the other adapters, your router's or provider's resolver can receive copies of your lookups.
• Proxy mode instead of VPN mode. Many desktop clients for VLESS profiles run either as a system proxy or as a full VPN, often called TUN mode. A system proxy covers only programs that respect proxy settings; everything else goes out directly.
• Split tunneling. Excluded apps use your regular connection and regular DNS by design. The split tunneling guide explains how routing rules and DNS should stay consistent.
• Leftover settings. A manually entered DNS server, an old VPN's virtual adapter or a DNS filtering app can override the VPN client's settings.
• Reconnects. After a network switch or sleep, the tunnel takes a few seconds to come back, and without a kill switch the system uses the bare connection in the meantime. Frequent drops are covered in why a VPN keeps disconnecting.

Browser secure DNS is a separate case. If your browser uses DNS over HTTPS with a provider you chose, the test shows that provider: lookups are encrypted and travel inside a full tunnel, but a third party resolves them instead of the VPN.

WebRTC leaks in the browser

WebRTC powers in-browser video calls, voice chat and file transfers. To connect directly, the browser asks a STUN server which public address its requests come from. Any web page can trigger this with JavaScript, without a call window or a permission prompt.

With a system-wide VPN in full-tunnel mode, the STUN request goes through the tunnel like everything else, so the page learns only the VPN server's address. A WebRTC leak happens when the request takes another route:

• You rely on a browser proxy extension, which routes ordinary web requests but often not WebRTC's UDP traffic.
• The browser is excluded by split-tunnel rules, or a desktop client runs in proxy mode.
• The VPN covers only IPv4 and the request leaves over IPv6.

Local addresses matter less than they used to. Current versions of Chrome, Edge, Firefox and Safari generally hide your private network address, typically behind a random .local name, unless the site has camera or microphone access.

Reducing WebRTC exposure

• Keep the browser inside a full-tunnel VPN rather than relying on a proxy extension.
• In Firefox, setting media.peerconnection.enabled to false on the about:config page turns WebRTC off. In-browser calls stop working until you switch it back.
• Chrome and Edge have no single built-in switch. Extensions that limit which network interfaces WebRTC may use, such as Google's WebRTC Network Limiter, are the usual option.

IPv6 leaks and why they're easy to miss

Many home and mobile networks give devices both an IPv4 and an IPv6 address, and operating systems generally prefer IPv6 when a site supports both. If the VPN routes only IPv4, those connections leave through your ordinary network with your real IPv6 address, which is often tied to one household or even one device. That's an IPv6 leak.

In WireGuard-based profiles, including AmneziaWG, the AllowedIPs line decides what enters the tunnel: 0.0.0.0/0 covers IPv4 and ::/0 covers IPv6. A profile that lists both sends IPv6 into the tunnel, where the server either routes or drops it. If yours lists only 0.0.0.0/0 and a test shows your provider's IPv6 address, turn IPv6 off on the computer while you use the VPN:

• Windows: open the Wi-Fi or Ethernet adapter's properties and clear the Internet Protocol Version 6 (TCP/IPv6) checkbox.
• macOS: in the Wi-Fi or Ethernet details under TCP/IP, set Configure IPv6 to Link-local only.
• Phones: usually leave IPv6 alone. Some mobile carriers run IPv6-only networks, and disabling it can break mobile data.

How to run a DNS leak test for your VPN and read the results

Public tools such as dnsleaktest.com, ipleak.net and browserleaks.com make your browser look up randomly generated subdomains, then record which resolvers asked about them. That shows the path your queries actually take, not what your settings claim.

1. Disconnect the VPN, open the test and note your IP, provider name and DNS servers. This is your baseline.
2. Connect the VPN in full-tunnel mode and check that split tunneling doesn't exclude your browser. With Flex-VPN, use your AmneziaWG key in Amnezia VPN or your subscription link in Happ.
3. Close and reopen the browser to drop old connections and cached lookups, then rerun the test, choosing the extended DNS test if one is offered.
4. Compare the IP, DNS server list, WebRTC section and IPv6 line with your baseline.
5. Repeat on a second network, after the device wakes from sleep and in any other browser you use.

Don't judge by country. Large public resolvers answer from many locations, so one can appear outside the VPN server's country. The red flag is your own provider's name.

How to fix DNS leaks on Windows, macOS, Android and iPhone

On every platform, start with full-tunnel mode, one VPN app at a time and a review of split-tunnel exclusions. Then follow the steps for your system and retest after each change.

Windows

1. Switch the client from proxy mode to full VPN or TUN mode if it offers both.
2. Run ipconfig /all and check the DNS servers listed for each adapter. Remove manual entries you no longer need.
3. Turn off Smart Multi-Homed Name Resolution: in the Local Group Policy Editor (Pro and Enterprise) under Computer Configuration, Administrative Templates, Network, DNS Client, or with the DisableSmartNameResolution registry value on Home editions. This is an extra layer; the client's DNS handling matters more.
4. Uninstall VPN clients you no longer use, because their virtual adapters can keep their own DNS settings.

macOS

• Run scutil --dns in Terminal. With the VPN connected, a resolver tied to its utun interface should list the VPN's DNS server. If only your router's address appears, the client hasn't applied its DNS settings.
• Remove configuration profiles and network extensions left behind by old VPN, filtering or DNS apps.

Android

1. Open the VPN settings (under Network & internet on many phones; under Connections, then More connection settings on Samsung), tap the gear icon next to your VPN app and turn on Always-on VPN and Block connections without VPN.
2. Check Private DNS. If it's set to a specific provider hostname, that provider may handle your lookups instead of the VPN's resolver and will show up in the test. Set it to Automatic if you want the VPN to handle DNS.

iPhone and iPad

• iOS has no system-wide kill switch toggle for third-party VPN apps, so behavior during reconnects depends on the app.
• Connect the VPN before opening apps. Connections opened earlier can stay on their old route, so force-close the browser before testing.
• Remove profiles from VPN or DNS services you no longer use under Settings, General, VPN & Device Management.

Kill switch and other ways to prevent DNS leaks

DNS leak protection in a client keeps lookups inside the tunnel while it's up. A kill switch covers the other half: it stops traffic when the tunnel drops, so nothing falls back to your bare connection. The most dependable kind is enforced by the operating system.

• Android: Always-on VPN combined with Block connections without VPN is enforced by the system, so it holds even while the VPN app restarts.
• Windows: some clients offer an option to block untunneled traffic; the official WireGuard client for Windows, for example, shows one for profiles that route all traffic. Custom firewall rules also work, but a mistake can cut off all access.
• macOS and iPhone: behavior depends on the client, so test it rather than assume.

To test a kill switch, keep a page loading and turn Wi-Fi off and on again, or on a phone switch from Wi-Fi to mobile data. Traffic should pause until the tunnel is back instead of continuing over the ordinary connection.

Habits that keep leaks away

• Retest after OS or client updates, on new networks and after changing split-tunnel rules.
• Prefer imported profiles to hand-edited ones. Flex-VPN provides a ready-made key or subscription link, and a Happ subscription updates its server list on its own, which leaves fewer manual settings to get wrong. Apps are on the download page.
• If a test shows your provider's DNS while Flex-VPN is connected, send a screenshot of the result with your device and app name to support.