What Is a DNS Leak and How Do We Prevent It?
On this page 6
You have turned on your VPN and you are sure that everything is private. But if a DNS leak exists, your internet provider can still see which sites you visit. This is one of the most common and least understood privacy problems.
What is DNS?
DNS is like the internet's phone book. When you type an address such as example.com, your device asks a DNS server: “What is the numeric address of this site?” That query includes the name of the site you want to open.
What does a DNS leak mean?
Ideally, these queries also pass inside the VPN tunnel and reach the DNS server of the VPN service. With a DNS Leak, however, the queries slip out of the tunnel and reach the DNS server of your internet provider (or any other server outside the VPN).
The result: the content of your traffic is encrypted, but the list of domains you open is still visible.
Common causes of DNS leaks
- Operating system DNS settings: some systems query DNS through several paths at once (for example Windows with the Smart Multi-Homed Name Resolution feature).
- Incomplete VPN app configuration or a config that does not send DNS inside the tunnel
- Browser DNS (DoH), whose settings are independent of the VPN
- A momentary drop in the VPN connection that, without a Kill Switch, sends traffic directly
How do we tell whether there is a leak?
- Connect the VPN.
- Go to a DNS Leak test site (such as dnsleaktest.com or browserleaks.com/dns).
- Look at the list of DNS servers. If the name of your own internet provider or servers from your country appear there, you probably have a leak.
Solutions
- Use your VPN's own DNS and enable the “prevent DNS leaks” options in the app settings.
- Turn on the Kill Switch.
- In the browser, check the DNS-over-HTTPS setting and keep it in line with your VPN settings.
- On Windows, check or disable the multi-path name resolution features.
- Test again after every change.
Choosing the right service matters too
A good service should manage DNS inside the tunnel and have support that guides you through fixing these problems. At BlendIn VPN, 24-hour support is available; if the result of your DNS test looks suspicious, ask in the support chat.
