What Is a DNS Leak?
A DNS leak is when domain-name requests use a resolver outside the route you expected, such as a VPN tunnel.
How it works
DNS converts names like example.com into addresses. When using a VPN, you may expect those queries to travel through the VPN provider's resolver or the same protected path. A leak test must observe which resolver reaches a controlled authoritative DNS service; simply listing your configured DNS server is not enough to prove the path.
A browser can have its own secure-DNS preference, an operating system can have a configured resolver, and a VPN application can provide another path. These layers are why a valid DNS-leak test must observe actual DNS traffic rather than infer it from a single setting.
A resolver seeing a domain request does not reveal every page action or personal detail. Still, it can matter to people who expect their VPN to handle name resolution. The right response is to compare the result with the provider's documented design.
Practical guidance
- Use a VPN provider's documented DNS-leak test when it operates the required observation infrastructure.
- Check whether your operating system, browser, and VPN have separate DNS or secure-DNS settings.
- Do not treat any single DNS server name as proof that a leak occurred.
Common question
Is a DNS leak always dangerous? It can matter when your goal is to keep browsing destinations from a local resolver, but its significance depends on your privacy expectations.