How to fix a DNS leak on Windows, Mac, iPhone, Android and your router

What a DNS leak is, in plain words

Before your device can load a website, it must turn the name (such as example.com) into an IP address. It asks a DNS resolver for that. Normally the resolver belongs to your internet provider or your router. When you use a VPN, the VPN app should also send those questions through its tunnel to its own resolver, so your provider cannot see the list of sites you visit.

A DNS leak happens when some or all of those questions still go to your provider's resolver, or to a resolver that does not belong to the VPN. Your web traffic may be hidden, but the list of names you looked up is not. See the glossary entry on DNS leaks for the short definition.

A leak does not always mean your VPN is broken. It is often a setting on your device, your router or your browser that sends lookups the wrong way. Some results are also harmless by design: if you deliberately use a private DNS service of your own choice, seeing it in the results is expected. What matters is that the resolvers shown are the ones you intended.

Step 1: confirm the leak

First, turn on your VPN or proxy and connect to a server. Then open the DNS leak test. It shows which DNS resolvers answered for you and which networks run them. Compare the list with your internet provider. If the results show your provider's name, and you expected your VPN's resolver, you have a leak.

For a wider picture, run the full border check, which also shows your address, WebRTC result and headers. Write down the results before you change anything, so that you can compare afterwards. If your VPN is doing its job, the resolvers should belong to the VPN company or to a public resolver you chose on purpose, and not to your home provider.

Step 2: fix it in your VPN app first

Most DNS leaks are fixed in the VPN app, not in the operating system. Open the app's settings and look for options like the ones below. Names differ between apps, so read the description of each option instead of searching for exact words.

• A setting that makes the app use its own DNS, often described as "use VPN DNS", "DNS leak protection" or "secure DNS". Turn it on.
• A kill switch, which blocks internet access when the VPN drops, so nothing goes out on the normal connection. Some apps call it "network lock" or "block connections without VPN".
• IPv6 handling. If the VPN does not carry IPv6 traffic, enable the option that blocks or disables IPv6 while connected, since IPv6 lookups can otherwise bypass the tunnel.
• Split tunneling. If it is on, check which apps are excluded from the VPN. Excluded apps and their lookups use your normal connection by design. Turn it off while you test.
• The protocol. If leaks persist, try another protocol in the app, if it offers a choice, then reconnect and test again.

If you use a custom or manual VPN profile, make sure it specifies a DNS server inside the tunnel. A profile without one leaves the device using whatever resolver it had before. If the app has no DNS options at all and the leak persists, update the app, and if that does not help, contact the provider or consider a different service.

Windows 10 and 11

Windows can send lookups to more than one network adapter at once, which is a classic cause of leaks with VPNs. The steps below work on current versions of Windows 10 and Windows 11. Menu labels can change a little between updates, so follow the general path if a name looks different.

• Disconnect the VPN, then open Settings and go to the network section. Choose Wi-Fi or Ethernet, open the properties of the network you use, and look for the DNS server assignment.
• On Windows 11, select Edit next to DNS server assignment and choose Manual. You can enter a DNS server of your choice for IPv4 and IPv6. Windows 11 can also use encrypted DNS (DNS over HTTPS) with known servers, and shows the option beside each address you enter. Pick the encrypted option if you want your lookups encrypted outside the VPN.
• On Windows 10, the older Control Panel route is the usual one: open the network connections list, open the properties of your adapter, select Internet Protocol Version 4 (TCP/IPv4), then Properties, and choose a DNS server manually. Repeat for IPv6 if you use it, or turn IPv6 off on that adapter if your VPN does not support it.
• Reconnect the VPN and check the adapter that the VPN creates. A VPN should supply its own DNS server for that adapter. If it does not, set the VPN's recommended DNS address manually, or set the app option described in Step 2.
• Restart the VPN and flush the old lookups. Open a Command Prompt and run ipconfig /flushdns to clear cached answers, then run the test again.

macOS

On a Mac, DNS settings are set per network connection. Open System Settings, go to Network, select your connection (Wi-Fi or Ethernet), open its details, and choose the DNS section. You will see the servers that connection uses.

• If the list shows your provider's or router's address, and you want a different one, add the address you prefer and remove the others. Apply the change.
• If you use a VPN app, make sure it is running while you check. VPN apps usually override DNS for the tunnel automatically, and a manual setting on your Wi-Fi connection can still be used when the VPN is off.
• Check for a second network service, such as a USB adapter or a hotspot, that has its own DNS settings. Services are tried in order, so move your preferred connection to the top, or turn off the unused ones.
• Clear cached answers. In Terminal, run sudo dscacheutil -flushcache followed by sudo killall -HUP mDNSResponder. The command wording has been stable across recent macOS versions, but check Apple's support pages if it does not work on yours.
• If your VPN uses a configuration profile, open the VPN section of System Settings and make sure the profile is active, then reconnect and retest.

iPhone and iPad

On iOS and iPadOS, the VPN app sets DNS for the tunnel, so most fixes are inside the app. You can also review the settings for the Wi-Fi network you use.

• Open Settings, then Wi-Fi, tap the information button next to your network, and look for Configure DNS. Automatic uses the network's resolver. Manual lets you enter your own. If you use a VPN, leave this on Automatic unless the VPN says otherwise.
• In the VPN app, enable its DNS protection or kill switch option if it has one. Apple's system does not offer a general kill switch, but some VPN apps provide an always-on or on-demand mode that approximates it. Check what your app offers.
• In the VPN section of Settings (under General), look at the status of your VPN configuration and make sure it is connected when you test.
• Consider iCloud Private Relay. It is a separate Apple feature that routes some Safari and app traffic through its own system, and it can interact with a VPN. Check Apple's documentation for how it behaves on your version, and test with it on and off.
• Restart the phone after changing network settings, then run the DNS leak test in Safari while connected.

Android

Android has a Private DNS setting, available on Android 9 and later. It encrypts lookups, but it can also send them to a resolver that is not your VPN's. The right setting depends on your goal.

• Open Settings and look under Network and internet (the name and the position vary between phone makers) for Private DNS. Options are normally Off, Automatic, or a specific provider's hostname.
• If your VPN app supplies DNS through the tunnel, set Private DNS to Off while connected, or follow the VPN provider's instructions. Some VPN apps work with Private DNS and some do not.
• Turn on Always-on VPN and the option that blocks connections without VPN. These are in the VPN settings: tap the settings icon next to your VPN. This acts as a system-level kill switch.
• Check for apps excluded from the VPN in the app's own split tunneling settings.

Phone makers move these menus around, so if you cannot find one, use the search box inside Settings and type the name of the feature.

Routers

Your router tells every device on your network which DNS server to use. If it points to your provider, devices without a VPN use that resolver, which is normal. Some people set a different resolver at the router so that every device benefits.

• Sign in to your router's admin page, using the address and password printed on the device or in its manual.
• Find the internet or WAN settings and look for the DNS servers. Some routers also have a separate setting for the DNS servers handed out to devices through DHCP.
• Enter the DNS servers you want, save, and restart the router if required. If you use a VPN on the router itself, follow the router software's instructions for DNS leak protection.
• Look for an option to use encrypted DNS (DNS over TLS or DNS over HTTPS). Not every router has it, and some need a firmware update.

Browser secure DNS (DNS over HTTPS) settings

Many browsers can encrypt their own DNS lookups with DNS over HTTPS (DoH). This hides lookups from the local network, but it can also send them to a resolver that is not your VPN's. If you use a VPN with its own DNS, you usually want the browser to use the system's DNS so that the VPN's resolver is used. If you do not use a VPN, turning DoH on can add privacy on a shared network.

Menu names change between browser versions, so treat the paths below as a guide and use the browser's settings search box if a label looks different.

• Chrome: open Settings, then Privacy and security, then Security. Find the Use secure DNS option. You can use your current service provider, or choose another provider from a list. Turn it off, or keep it on the current provider, to follow the system or VPN.
• Firefox: open Settings, then Privacy and Security, and scroll to the DNS over HTTPS section. Firefox offers levels of protection, including a default, an increased and a maximum level, as well as off. Choose the level that matches your goal.
• Edge: open Settings, then Privacy, search, and services, and look in the Security section for the secure DNS option. It works like Chrome's option, with choices of the current service provider or another provider.
• Safari: Safari has no DoH switch of its own. It uses the DNS settings of your Mac, iPhone or iPad, including any encrypted DNS profile or VPN you have installed. To change how Safari looks things up, change the system settings described above.

After changing a browser setting, close all windows, reopen the browser, and run the DNS leak test again. Use a private window so extensions do not interfere.

Step 3: test again and read the result

Once you have changed a setting, connect to your VPN, wait a few seconds, and run the DNS leak test again. You want to see resolvers that belong to your VPN company, or to the public service you chose on purpose, and not your internet provider.

Run the WebRTC leak test too, because it checks a different path by which your real address can show. If you use a proxy and not a VPN, see the proxy checker. Finally, the full border check shows all of these in one report. Changing one setting at a time makes it easier to know which fix worked.

If the leak is still there

• Make sure that only one VPN or security app is controlling your network settings. Two apps can fight over DNS.
• Turn off IPv6 temporarily, or enable your VPN's IPv6 protection, and test again.
• Check for browser extensions that change DNS or proxy settings, and test in a clean browser profile.
• Update the VPN app, your operating system and your browser.
• Try a different VPN server or protocol, in case the problem is specific to one of them.
• If you use a proxy only, remember that a proxy covers one app. Lookups may still use your normal resolver unless the proxy type, such as SOCKS5 with remote DNS, sends them through.

If nothing works, contact the VPN provider and share the leak test result. A reliable provider should help you reproduce and fix a leak, or tell you what it does not cover.

How to avoid leaks in the future

Finally, remember what a clean result means and does not mean. It shows that, at that moment, your lookups went where you expected. It does not prove your connection is private or anonymous. For the bigger picture, read VPN vs. proxy and the guide on WebRTC leaks.