GLOSSARY
DNS leak
A DNS leak is when your device sends its DNS lookups to a resolver you did not intend, usually your internet provider's, while you believe a VPN or proxy is handling your traffic. The visits themselves may be hidden, but the list of site names you ask for is exposed.
Why it matters
DNS lookups reveal which sites you visit even when the page contents are encrypted. A leak undermines one of the main reasons for using a VPN, and it is often silent: everything seems to work, and nothing warns you. Leaks arise from system settings, IPv6 traffic, split tunneling, browser DoH or a VPN dropping its connection.
In practice
To test, connect to your VPN and run the DNS leak test, then check who operates the resolvers listed. Your VPN's resolvers or a service you chose are fine, while your home provider's are a leak. Our guide walks through the fixes for Windows, macOS, phones, routers and browsers, and a kill switch covers the case where the VPN drops.
Related terms
- DNS resolver: A DNS resolver is the server that does the lookup work on your behalf.
- VPN: A VPN creates an encrypted tunnel between your device and a server operated by the VPN service.
- Kill switch: A kill switch is a VPN feature that blocks your internet access whenever the VPN connection drops, so that no traffic is sent over your normal, unprotected connection.
- WebRTC: WebRTC is a set of browser features that lets web pages make direct audio, video and data connections between devices, without plug-ins.