When you visit a website, your device first asks a DNS server to translate the domain name (e.g. example.com) into an IP address. That DNS query can reveal which sites you are looking up — even before you connect to them. A VPN is supposed to route these queries through the encrypted tunnel to the VPN provider's DNS servers, hiding them from your ISP. A DNS leak means that does not happen.
In a DNS leak, your device sends DNS queries outside the VPN tunnel. Usually they go to your ISP's DNS servers. Your ISP can then see every domain you resolve: which news sites you read, which services you use, when you are active. The VPN encrypts your actual traffic, but the DNS leak reveals your browsing pattern. For privacy-focused VPN use, that defeats much of the purpose. Even if your web traffic is encrypted with HTTPS, the DNS query alone tells your ISP which site you are visiting. That is often enough to build a profile of your interests and behavior. Over time, ISPs and other observers can correlate DNS queries with your identity, even when the actual content is encrypted.
DNS leaks are common. They can happen because of IPv6 (if the VPN does not handle IPv6 DNS), because the OS or browser uses a different DNS path, or because of misconfiguration after a reconnect. The good news: they are detectable and preventable. This guide explains what causes DNS leaks, how to test for them, and how to fix them. We also cover browser DNS-over-HTTPS (DoH), which can bypass VPN DNS protection entirely if not configured correctly. Many users are unaware of DoH; it is enabled by default in some browsers and sends DNS directly to third-party providers.
We cover the technical causes, step-by-step testing, and what to look for in a VPN to prevent leaks. By the end, you will know how to verify your VPN is not leaking DNS and what to do if it is. KloxVPN includes DNS leak protection and a free DNS leak test tool so you can confirm your connection is secure. Run the test regularly — especially after reconnects or when using a new network. A VPN that does not leak on your home network might leak on a different WiFi or after a mobile handoff.
DNS leaks are often silent. You may not notice any problem; your VPN connects, websites load, and everything seems fine. But in the background, your DNS queries could be going to your ISP. The only way to know is to test. We provide step-by-step instructions and explain what a clean result looks like. We also cover browser DNS-over-HTTPS, which can bypass VPN DNS protection entirely. Many users enable DoH for privacy without realizing it conflicts with their VPN. This guide helps you avoid that pitfall.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
What Causes DNS Leaks?
Common causes include the OS or browser using a different DNS path than the VPN (e.g. IPv6 or another interface), VPN clients that do not force all DNS through the tunnel, and misconfigured network settings after reconnects.
IPv6 is a frequent culprit. Many VPNs only route IPv4 traffic through the tunnel. If your network has IPv6, your device may send DNS queries over IPv6, bypassing the VPN. The VPN's DNS servers might not even be reachable over IPv6. Result: DNS leaks. Dual-stack networks (IPv4 and IPv6) are increasingly common; a VPN that does not handle both can leak on IPv6 even when IPv4 is fine.
Another cause is the OS or browser choosing a different DNS path. Windows, macOS, and Linux have complex networking stacks. The VPN client must ensure that all DNS requests — regardless of which app sends them — go through the VPN interface. If the OS prefers a different interface (e.g. Ethernet over the VPN virtual adapter), DNS can leak. Browsers with built-in DNS-over-HTTPS (DoH) add another layer: they may bypass system DNS entirely and send queries directly to Cloudflare, Google, or another provider. The VPN cannot intercept those queries.
Reconnects and network changes can also trigger leaks. When the VPN drops and reconnects, the routing table may not be updated correctly. DNS might temporarily or permanently use the wrong path. A kill switch helps by blocking traffic during the gap, but DNS configuration must be re-established correctly when the VPN comes back. Bugs in reconnect logic have caused leaks in the past; testing after reconnects is important.
IPv6 and Dual-Stack Networks
If your network has IPv6 and your VPN does not properly route IPv6 DNS through the tunnel, queries can leak over IPv6. Many VPNs disable IPv6 or route it through the tunnel; if yours does not, IPv6 DNS may go to your ISP. Dual-stack networks are increasingly common: your home or office may have both IPv4 and IPv6. When you connect to a VPN that only handles IPv4, your device may prefer IPv6 for DNS resolution. The VPN tunnel carries IPv4 traffic, but IPv6 DNS queries take a different path. The result is a leak that only appears when you run an IPv6-specific test. Some leak test tools run IPv4 and IPv6 tests separately; run both. If you see your ISP on the IPv6 test, your VPN is not fully protecting DNS. Disabling IPv6 at the OS level is a workaround, but a VPN that properly routes or blocks IPv6 DNS is the better solution.
OS and Browser DNS Behavior
Operating systems and browsers can use system DNS, DNS-over-HTTPS, or their own resolvers. The VPN must intercept or override all of these. If the browser uses DoH to a third-party server, that can bypass the VPN. VPN clients that only change the system DNS may miss browser-specific behavior. Firefox, Chrome, and Edge all offer DoH; when enabled, they send DNS queries directly to Cloudflare or Google over HTTPS, bypassing the VPN's DNS. The VPN never sees those queries. To fix this, disable DoH in your browser when using a VPN, or use a VPN that explicitly handles DoH. Some VPNs document which browsers and settings they support; check before assuming system DNS is enough.
Reconnect and Network Change
When the VPN disconnects and reconnects, DNS settings may not be restored correctly. The OS might fall back to ISP DNS during the gap. A kill switch blocks traffic, but once the VPN is back, the client must re-apply DNS configuration. Bugs in reconnect logic can leave DNS leaking. Mobile users are especially affected: switching between WiFi and cellular triggers reconnects. If the VPN client does not correctly re-establish DNS routing after a handoff, DNS may leak until the next full reconnect. Test after every reconnect. Some users run a DNS leak test after connecting and assume they are protected for the session. But a brief disconnect and reconnect can leave DNS misconfigured. Make testing part of your routine, especially when using mobile or unstable networks.
Split Tunneling and Excluded Apps
If you use split tunneling and exclude certain apps, those apps may use your system DNS instead of the VPN's. Their DNS queries could go to your ISP. This is by design for excluded apps, but it is a form of DNS leak for that traffic.
How to Test for DNS Leaks
Use a DNS leak test tool (such as the one at klox.app/tools/dns-leak-test) while connected to your VPN. The test shows which DNS servers responded; they should belong to your VPN provider, not your ISP.
The test works by loading a page that makes DNS requests from your browser. The page then reports which DNS servers responded and their IP addresses. You compare those to your VPN provider's DNS servers and your ISP's. If you see your ISP's DNS servers or your ISP's IP range, you have a leak. Third-party leak test sites (e.g. dnsleaktest.com, ipleak.net) work similarly; they resolve test hostnames and report which servers answered. The key is to verify the responding servers match your VPN provider.
Run the test with the VPN connected. Disconnect your normal connection first if you want to be thorough — that way any leak will be obvious. Some tests also check for IPv6 leaks separately. Run both IPv4 and IPv6 tests if your network supports IPv6. If you use split tunneling, run the test from an app that is routed through the VPN; testing from an excluded app will show your real DNS, which is expected.
Be aware that some leak tests use different methods. Extended tests send multiple queries to different hostnames and may reveal leaks that a quick test misses. Run an extended test periodically for a more thorough check.
Step-by-Step Testing
Connect to your VPN. Open a DNS leak test page in your browser. Let the test run; it will show which DNS servers responded. Check the server names and IPs. They should match your VPN provider. If you see your ISP's name or IPs, you have a leak.
What a Clean Result Looks Like
A clean result shows only your VPN provider's DNS servers. The IP addresses should be in ranges owned by the VPN provider or their DNS partner. You should not see your ISP's name or your geographic location (unless the VPN uses geo-based DNS).
IPv6-Specific Tests
Some leak tests check IPv6 separately. If your network has IPv6 and your VPN does not handle it, IPv6 DNS may leak even when IPv4 is fine. Run an IPv6 leak test if available. If you see your ISP on IPv6, consider disabling IPv6 or using a VPN that properly routes it.
When to Retest
Test after connecting, after reconnects, and after network changes (e.g. switching from WiFi to Ethernet). Test on each device and network you use. A VPN that does not leak on home WiFi might leak on a different network or after a mobile handoff.
How KloxVPN Prevents DNS Leaks
KloxVPN routes DNS through the encrypted tunnel and uses VPN-assigned DNS servers. The kill switch also helps prevent exposure if the connection drops. Run the DNS leak test after connecting to verify.
Our VPN client configures your device to use our DNS servers for all queries when the VPN is connected. We route DNS through the tunnel so your ISP never sees your queries. We handle IPv6 to prevent IPv6 DNS leaks. When the VPN disconnects, the kill switch blocks traffic until reconnection, so no DNS queries go out during the gap. Our client applies DNS configuration at the system level so that all applications — browsers, apps, background services — use our DNS when the VPN is active.
We provide a free DNS leak test at /tools/dns-leak-test. Use it after connecting to confirm you are not leaking. We recommend testing periodically, especially after app updates or when using a new network. If you use split tunneling and exclude certain apps, those apps will use your system DNS (outside the VPN) by design; our leak protection applies to traffic that is routed through the tunnel.
DNS Routing
KloxVPN forces all DNS through the VPN tunnel. We assign our DNS servers when you connect and configure your system to use them. Queries are encrypted and sent to our infrastructure, not your ISP.
Kill Switch Integration
When the VPN drops, the kill switch blocks all traffic, including DNS. No queries leave your device until the VPN reconnects. That prevents leaks during brief disconnects.
IPv6 Handling
We handle IPv6 to prevent IPv6 DNS leaks. If your network has IPv6, we ensure IPv6 DNS also goes through the tunnel or is disabled to prevent leaks.
Verification
Run our DNS leak test after connecting. The result should show only our DNS servers. If you see your ISP, contact support — we want to fix any leak.
Summary and Key Takeaways
A DNS leak occurs when your device sends DNS queries outside the VPN tunnel, usually to your ISP. Your ISP can then see which domains you look up, undermining the privacy the VPN provides. Common causes include IPv6 (when the VPN does not route IPv6 DNS), OS or browser using a different DNS path, reconnect bugs, and split tunneling with excluded apps.
Test regularly with a DNS leak test tool. Connect to your VPN, run the test, and verify that only your VPN provider's DNS servers appear. If you see your ISP, you have a leak. Try a different server or protocol. Disable IPv6 if necessary. Check that split tunneling is not excluding apps that send DNS. Disable browser DNS-over-HTTPS when using a VPN, or use a VPN that handles DoH.
A quality VPN forces all DNS through the tunnel and handles IPv6. KloxVPN routes DNS through the encrypted tunnel and provides a free DNS leak test. Run it after connecting and periodically thereafter. If you see your ISP in the results, contact support. Document the exact conditions (network, device, protocol) when the leak occurs — that information helps providers fix bugs.
Test Regularly
Run a DNS leak test after connecting and periodically. Leaks can appear after reconnects or network changes.
Common Fixes
Try a different server or protocol. Disable IPv6. Disable DoH in your browser. Check split tunneling.
Prevention Checklist
Use a VPN with built-in DNS leak protection. Run the leak test after every connect and after reconnects. Disable IPv6 if your VPN does not handle it. Disable browser DoH when using a VPN. Avoid split tunneling for apps that send sensitive DNS queries. Test on each network you use.
DNS Leak vs WebRTC Leak
DNS leaks and WebRTC leaks are different. A DNS leak means your domain lookups go to your ISP. A WebRTC leak means your browser can reveal your real IP through WebRTC (used for video calls). Both undermine VPN privacy. Run both tests: our DNS leak test and WebRTC leak test. Fix both if you find issues. Some VPNs include WebRTC leak protection; others require browser settings or extensions.
Key Takeaways
A DNS leak means your DNS queries bypass the VPN and go to your ISP. Your ISP can see which sites you look up, undermining the privacy the VPN is supposed to provide. DNS leaks are common but preventable.
Causes include IPv6, OS and browser DNS behavior, reconnect bugs, and split tunneling. A good VPN forces all DNS through the tunnel and handles IPv6. Test regularly with a DNS leak test tool to verify. Make testing part of your routine: after every connect, after reconnects, and when switching networks. A VPN that does not leak on your home network might leak on a coffee shop WiFi or after a mobile handoff.
KloxVPN routes DNS through the encrypted tunnel and provides a free DNS leak test. Connect, run the test, and confirm you are not leaking. If you see your ISP in the results, something is wrong — and we want to fix it. Report leaks with details about your network, device, and protocol so we can reproduce and fix the issue.
Browser DNS-over-HTTPS (DoH) can bypass VPN DNS protection. If your browser uses DoH to Cloudflare, Google, or another provider, those queries go directly to that provider — not through the VPN. To ensure full DNS protection, disable DoH in your browser when using a VPN, or use a browser that respects system DNS. Some VPNs intercept DoH; check your provider's documentation. Testing with DoH enabled and disabled can reveal whether your browser is leaking DNS outside the VPN.
Make DNS leak testing part of your routine. Run the test after every connect, after reconnects, and when switching networks. A VPN that does not leak on your home WiFi might leak on a coffee shop network or after a mobile handoff. Document when leaks occur: network type, device, protocol. That information helps providers fix bugs and helps you choose workarounds (e.g. disable IPv6, switch protocol) when needed. Prevention is easier than diagnosis; a quality VPN with built-in leak protection reduces the chance of leaks from the start.
KloxVPN routes all DNS through the tunnel and handles IPv6. We provide a free DNS leak test at /tools/dns-leak-test. Use it after connecting and periodically. If you ever see your ISP in the results, contact support — we want to fix it. DNS leak protection is not optional for a privacy-focused VPN; it is a core feature. Your browsing pattern should never be visible to your ISP when the VPN is connected.
Some users assume that because their VPN connects and websites load, DNS must be working correctly. That assumption is wrong. A VPN can connect successfully while DNS still leaks to your ISP. The only way to know is to test. Make the DNS leak test part of your connection routine: connect, run the test, then browse. If you switch networks or protocols, test again. The test takes seconds; the peace of mind lasts.
Related Resources
Test Your Connection for DNS Leaks
Free DNS leak test and built-in leak protection with KloxVPN.
Get KloxVPNFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.