Last updated: March 18, 2026

Verify your VPN isn’t leaking DNS requests using online test tools like dnsleaktest.com, if you see your ISP’s servers in results instead of your VPN provider’s, your browsing history is exposed. Fix IPv6 leaks, misconfigured split tunneling, and default gateway issues to ensure complete DNS protection.

Table of Contents

Prerequisites

Before you begin, make sure you have the following ready:

Step 1 - What Exactly is a DNS Leak?

Every time you visit a website, your computer needs to translate a human-readable domain name (like example.com) into an IP address. This translation happens through DNS (Domain Name System) servers. Normally, when you’re not using a VPN, your device sends DNS queries to your ISP’s DNS servers, giving them a complete log of every website you visit.

When you connect to a VPN, the expectation is that all your DNS queries get routed through the VPN’s encrypted tunnel to the VPN provider’s DNS servers. Your ISP shouldn’t see any of this traffic. However, due to various technical issues, your device might inadvertently send some DNS queries outside the VPN tunnel, directly to your ISP or other third-party DNS servers. This is a DNS leak.

The danger is real - even with military-grade encryption on your VPN traffic, a DNS leak exposes your browsing history. Your ISP knows exactly which domains you visited, defeating the purpose of using a VPN for privacy.

Why Do DNS Leaks Happen?

Several factors can cause DNS leaks:

IPv6 Compatibility Issues - IPv6 is the newer internet protocol, but many VPNs don’t properly handle IPv6 traffic. If your device prefers IPv6 and your VPN only routes IPv4, your DNS queries for IPv6 addresses can leak outside the tunnel.

Default Gateway Problems - Some operating systems have a default gateway configuration that doesn’t properly route all traffic through the VPN. This is particularly common on Windows.

Split Tunneling Misconfiguration - When only certain apps use the VPN while others bypass it, DNS queries from non-VPN apps can leak.

VPN Protocol Weaknesses - Some VPN protocols have known issues that can cause leaks under certain network conditions.

Step 2 - How to Test for DNS Leaks

Testing for DNS leaks is straightforward. Here’s how to do it:

Method 1 - Using Online DNS Leak Test Services

The easiest approach is using dedicated DNS leak test websites:

  1. Connect to your VPN
  2. Visit a DNS leak test site like dnsleaktest.com or ipleak.net
  3. Run the extended test

What to look for - The test results should show DNS servers that belong to your VPN provider, not your ISP. If you see your ISP’s servers or servers in your physical location, you have a DNS leak.

Method 2 - Manual DNS Check

You can also verify which DNS servers your system is using:

On macOS/Linux:

Check current DNS servers
scutil --dns | grep 'nameserver'

Or use nslookup to see which server resolves a query
nslookup example.com

On Windows:

ipconfig /all | findstr "DNS Servers"

Compare the DNS servers shown with what your VPN provider advertises. If they don’t match, you have a leak.

Method 3 - Using Terminal Commands for Detailed Analysis

For more thorough testing, use these commands:

On macOS:

Monitor DNS queries in real-time
sudo tcpdump -i any -n port 53

This shows all DNS queries leaving your system. With a properly working VPN, you should only see queries going to your VPN’s DNS servers.

On Linux:

Use dig to test specific DNS servers
dig @dns-server-ip example.com

Or check current DNS configuration
cat /etc/resolv.conf

Step 3 - Fixing DNS Leaks

If you’ve detected a DNS leak, here’s how to fix it:

  1. Enable DNS Leak Protection in Your VPN

Most reputable VPN apps have built-in DNS leak protection. Check your VPN settings:

  1. Configure Your Operating System

You can force your system to use specific DNS servers:

On Windows:

  1. Go to Network & Internet → Wi-Fi or Ethernet
  2. Click on your connection → Hardware properties
  3. Scroll to DNS server assignment and select Manual
  4. Enter your VPN provider’s DNS servers

On macOS:

  1. Go to System Settings → Network → Wi-Fi (or Ethernet)
  2. Click Details → DNS
  3. Add your VPN provider’s DNS servers

On Linux (NetworkManager):

  1. Edit your connection settings
  2. Go to IPv4 Settings or IPv6 Settings

  3. Set DNS servers to your VPN provider’s addresses

  4. Disable IPv6

If your VPN doesn’t support IPv6, disabling it is the safest approach:

On Windows:

Disable IPv6 on all interfaces
netsh interface ipv6 install
netsh int ipv6 set interface interface_index disabled

On macOS:

Disable IPv6
networksetup -listallnetworkservices
Note your network service name, then:
networksetup -setv6off "Wi-Fi"

On Linux: Add this to /etc/sysctl.conf:

Disable IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Then apply with sudo sysctl -p

  1. Use a Firewall with VPN Kill Switch

A VPN kill switch blocks all internet traffic if the VPN connection drops, preventing any accidental leaks:

  1. Switch VPN Protocols

Some protocols are more prone to leaks than others. Try switching:

Avoid PPTP or older protocols that have known security issues.

Step 4 - Test After Fixes

After implementing fixes, verify your VPN is no longer leaking:

  1. Disconnect and reconnect your VPN
  2. Clear your browser cache
  3. Run multiple DNS leak tests from different services
  4. Use the terminal command method to monitor actual DNS queries

Repeat tests at different times of day and on different networks to ensure the fix is consistent.

Step 5 - What to Do If Your VPN Still Leaks

If you’ve tried everything and your VPN still leaks:

  1. Contact your VPN provider: They may have specific fixes for your configuration
  2. Consider an alternative VPN: Some providers simply don’t implement proper leak protection
  3. Use system-level DNS over HTTPS (DoH): While not a perfect solution, routing DNS through HTTPS can add a layer of protection
  4. Try a privacy-focused Linux distribution: Some distros like Tails or Whonix have built-in leak protection

Best Practices for DNS Privacy

Beyond fixing leaks, consider these additional measures:

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

How long does it take to verify your vpn is not leaking dns requests in?

For a straightforward setup, expect 30 minutes to 2 hours depending on your familiarity with the tools involved. Complex configurations with custom requirements may take longer. Having your credentials and environment ready before starting saves significant time.

What are the most common mistakes to avoid?

The most frequent issues are skipping prerequisite steps, using outdated package versions, and not reading error messages carefully. Follow the steps in order, verify each one works before moving on, and check the official documentation if something behaves unexpectedly.

Do I need prior experience to follow this guide?

Basic familiarity with the relevant tools and command line is helpful but not strictly required. Each step is explained with context. If you get stuck, the official documentation for each tool covers fundamentals that may fill in knowledge gaps.

Is this approach secure enough for production?

The patterns shown here follow standard practices, but production deployments need additional hardening. Add rate limiting, input validation, proper secret management, and monitoring before going live. Consider a security review if your application handles sensitive user data.

Where can I get help if I run into issues?

Start with the official documentation for each tool mentioned. Stack Overflow and GitHub Issues are good next steps for specific error messages. Community forums and Discord servers for the relevant tools often have active members who can help with setup problems.

Related Articles