What is a DNS leak?

Why you should care

A VPN is only useful if the traffic you care about actually goes through it. If DNS requests leave the secure path, a network observer — often your ISP — can still see the domain names you look up, even when page content is encrypted with HTTPS.

That creates a false sense of security: the VPN may hide your public IP while your browsing habits leak through DNS.

What DNS does

DNS (the Domain Name System) turns names like skypath.cloud into IP addresses that routers can deliver packets to. Almost every visit to a website starts with a DNS lookup.

Most ISPs assign customers a DNS server they control. That server can log which domains you asked for — useful for the network operator, risky for privacy.

How a DNS leak happens

Even with a VPN connected, the operating system may keep using its default DNS servers instead of the ones the VPN provides. Split tunneling, bad client settings, or IPv6 can send DNS outside the tunnel while other traffic stays inside.

From your point of view the VPN looks “on.” From the network’s point of view, domain lookups still arrive at the ISP.

Browser secure DNS

Modern browsers often support encrypted DNS such as DNS-over-HTTPS, sometimes enabled by default. Encryption stops a local Wi‑Fi observer from reading the query in transit — which is good.

It does not mean “no one sees the name.” The secure DNS provider you chose (or the browser default) still receives the lookups. If that provider is not the VPN’s DNS, VPN users may treat it as another kind of leak.

Transparent DNS proxies

Some ISPs intercept every plain DNS request on port 53 and answer it themselves — a transparent DNS proxy. You may think you configured Google or Cloudflare DNS, yet the ISP still handles the query.

A VPN that properly tunnels DNS (or blocks outside DNS) is the usual fix. Changing only the “DNS server” field on your PC is not enough against interception on the open network.

How to check

Run a DNS leak test while the VPN is connected. You want to see resolvers that belong to the VPN (or that you intentionally chose), not your home ISP’s name.

For a clear before/after story, run once with the VPN off, note the operator names, connect the VPN, and run again. If the ISP still appears, DNS is not fully inside the tunnel.

Remember

• HTTPS hides page content; it does not hide the domain names in DNS lookups.
• Browser secure DNS and OS DNS can disagree — check both if results surprise you.
• IPv6 and split tunneling are common reasons a VPN looks connected while DNS still leaks.
• Re-test after you change VPN, browser, or network settings.

Related guides