DNS Leak Signals Explained: How to Check Your VPN in 2026

Your VPN is on, your IP shows you in another country, everything looks fine. But every domain you type in your browser — gmail.com, netflix.com, bankofamerica.com — may still be going to your ISP's DNS servers. This may be called a DNS leak when the resolver path does not match the intended tunnel. It is a privacy signal to investigate, not proof by itself that every site visit is logged or that a VPN is useless.

What Is DNS and Why Does It Matter?

DNS (Domain Name System) works like the phone book of the internet. When you type youtube.com in your browser, your computer must first translate that domain into an IP address. DNS servers do this translation. By default, your operating system uses your ISP's DNS servers (Comcast, Verizon, BT, Deutsche Telekom, etc.).

The problem: every domain you visit gets logged on those DNS servers. Your ISP knows exactly how often you connect to pornhub.com, wikipedia.org, protonmail.com. In many jurisdictions, these logs are retained for years.

Ideally, a VPN connection routes DNS queries through the encrypted tunnel and uses the VPN provider's own DNS servers (or privacy-focused alternatives like Cloudflare or Quad9). But this doesn't always work flawlessly.

How DNS Leaks Happen

DNS leaks have several typical causes:

Misconfiguration: The VPN client establishes the tunnel but fails to override the OS's DNS routing. Traffic goes through the VPN, DNS queries go to the ISP.

IPv6 leak: Most VPNs encrypt only IPv4 traffic. On an IPv6-enabled connection, IPv6 packets escape outside the tunnel.

Transparent DNS proxying: Some ISPs intercept DNS queries and redirect them to their own servers. Even queries leaving through the VPN can be hijacked.

WebRTC leak: Browsers' real-time communication API can bypass the VPN to expose your local and public IP.

Connection drop: When the VPN tunnel drops, DNS queries revert to the system DNS. This is why a kill switch is critical.

DHCP enforcement: Some routers force all DNS traffic to their own servers. If the VPN client can't override this, leaks occur.

How to Test for DNS Leaks

Useful independent tools for checking resolver signals include:

ipleak.net

The most comprehensive testing site. On a single page, it shows you:

• Public IPv4 address
• IPv6 address (if any)
• List of DNS servers being used and their locations
• IP detected via WebRTC
• Torrent IP detection

Open ipleak.net while the VPN is connected. Compare the displayed DNS servers with your provider's documentation or a known resolver. If you see your home ISP's DNS servers, investigate the routing and repeat the check with a second tool; one browser result is not a complete system-wide verdict.

dnsleaktest.com

Offers two test modes: standard test (5 queries) and extended test (about 30 queries). The extended test is more reliable because some leaks only trigger on specific domains.

Run the Extended Test while the VPN is connected. Compare the servers shown with the provider's documentation. If you see DNS from multiple different ISPs, treat it as a signal to investigate rather than a final diagnosis.

browserleaks.com

Provides detailed browser-based tests. It particularly exposes browser-level risks like WebRTC, fingerprinting, and canvas leaks. A VPN alone cannot close these vectors.

IPv6 Leak: The Most Commonly Overlooked Issue

IPv6 is the successor to IPv4 and is becoming increasingly common. Most major ISPs now support IPv6.

The problem: many VPN providers don't support IPv6. When the VPN connects, only IPv4 traffic goes through the tunnel. IPv6 packets exit through the regular network adapter with your real IPv6 address.

Result: tests checking IP through IPv4 say "everything is fine," but IPv6-supporting sites see your real location.

Solutions:

1. Enable your VPN provider's IPv6 support — ProtonVPN, Mullvad, AirVPN support it
2. Disable IPv6 entirely — turn it off in OS network settings
3. Enable the provider's "IPv6 leak protection" feature — available in modern clients

On ipleak.net, the "Your IPv6 address" field should be empty or show the VPN provider.

WebRTC Leak: The Browser's Betrayal

WebRTC (Web Real-Time Communication) is an API browsers use for video calls and file sharing. The problem: WebRTC must learn both your local and public IP to establish P2P connections, and it queries the OS's network stack directly, bypassing the VPN.

Result: depending on browser permissions and network configuration, a webpage may learn an IP signal through the WebRTC API. Reproduce the result under the same conditions before drawing a conclusion.

Solutions:

• Brave: Forces WebRTC to operate over the VPN by default
• Firefox: about:config and set media.peerconnection.enabled = false
• Chrome/Edge: WebRTC Network Limiter extension
• uBlock Origin: Settings > "Prevent WebRTC from leaking local IP addresses" enabled

On browserleaks.com/webrtc, the local IP should be empty or belong to the VPN.

DNS-over-HTTPS and DNS-over-TLS

Classic DNS queries go in plaintext (port 53). This means even without a VPN, DNS traffic is visible to anyone on the network. DoH (DNS-over-HTTPS) and DoT (DNS-over-TLS) encrypt these queries.

Modern browsers (Firefox, Chrome, Edge) support DoH by default. Cloudflare 1.1.1.1, Quad9 9.9.9.9, and NextDNS are popular DoH endpoints.

Subtle point: DoH protects DNS queries from network observers but doesn't enforce going through the VPN. If your browser's DoH provider is different from your VPN's, your VPN provider sees no DNS queries — but the DoH provider does. For consistency, configure DoH at the OS level using your VPN's resolver, or rely entirely on the VPN's DNS handling.

Fixing DNS Leaks

If a DNS resolver signal does not match your intended setup, work through these educational steps:

1. Update your VPN client: Older versions may have routing bugs. Upgrade to the latest version.

2. Switch protocol: WireGuard's DNS handling is generally cleaner than OpenVPN. If you're on OpenVPN, switch to WireGuard.

3. Enable DNS leak protection in the client: Most providers ship this option, but it isn't always on by default.

4. Disable IPv6 at the OS level: On Windows from Network Adapter properties, on macOS from Network preferences.

5. Override DNS manually: Set the OS's DNS servers to Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). VPN's own DNS adds another protection layer.

6. Block WebRTC: Use a browser extension or the Brave browser by default.

7. Use system-level kill switch: A kill switch prevents brief leak windows from appearing during connection drops.

If the signal persists, review the provider's documented DNS handling and contact its support. Do not infer a provider-wide leak rate from one connection; repeat the check on your own networks.

How VPN Providers Handle DNS

Provider implementations and documentation differ; read the scope and date of each claim.

Mullvad: Provider documentation describes its own DNS resolvers and ad/tracker blocking. Verify current IPv6 and WebRTC behavior on your device.

NordVPN: Provider documentation describes its own DNS and threat-protection features. NordLynx is WireGuard-based; route behavior still depends on the device and network.

ProtonVPN: Provider documentation describes its DNS infrastructure, NetShield and IPv6 leak-protection features; confirm the current app settings.

ExpressVPN: Provider documentation describes DNS protection and its own resolvers; confirm the current app behavior and scope.

Free VPNs: Privacy and DNS handling vary widely. Read the policy and technical documentation instead of assuming that a free or paid label proves a particular outcome.

When choosing a provider, look for "private DNS" or "no-logs DNS" features. The WireGuard vs OpenVPN comparison covers protocol-level DNS routing differences.

Frequently Asked Questions

How often should I run a DNS leak test? Test every time you change networks (home, work, public Wi-Fi). For sensitive uses, also after VPN updates and OS updates.

Does ipleak.net give a definitive answer? It is an indicator, not a 100% conclusive system-wide verdict. Cross-check with another tool and read what each tool actually queries.

Can a leak occur without my knowledge? Yes, settings can change after OS updates, network changes or client crashes. Recheck after material changes and use the provider's documented protections.

Are there free leak tests? Yes. ipleak.net, dnsleaktest.com, browserleaks.com — all free. Avoid paid leak testing tools, they offer no advantage.

Does mobile DNS leak too? Yes, particularly on Android. iOS has tighter network controls but isn't immune. Run the same tests on mobile.

Conclusion

DNS resolver routing is one privacy signal among several. Hiding an IP does not automatically hide every DNS or browser signal, and a single browser check cannot prove the full path. Modern providers document leak protections, but users should verify the scope and recheck after meaningful changes.

For a stronger privacy setup, learn how IPv4, IPv6, WebRTC and DNS interact; then verify each layer with tools that explain their scope. Our VPN comparison organizes provider documentation and audit evidence rather than promising a leak-proof setup.

Privacy isn't just hiding your IP — which domains you resolve is data just as valuable as the IP itself.