What is a DNS Leak and How to Know if Your VPN is Really Protecting You

Your VPN is turned on, the green padlock is visible in the app, and yet your internet service provider may still be seeing every website you visit. This is the typical scenario for a DNS leak: your IP address changes, but domain queries still go through your ISP. Here, you’ll learn exactly what this is, how to check for it in two minutes, and how to fix it.

What Is DNS and Why Does It Matter for Your Privacy

Every time you type net-analyzer.com or open an app, your device asks a DNS server which IP address corresponds to that name. It’s the Internet’s phone book: without it, there’s no connection.

The problem is that, by default, your Internet service provider (Movistar, Vodafone, Comcast…) answers those queries. Even if the content is encrypted via HTTPS, the list of domains you look up paints a fairly complete picture of your activity: which websites you visit, at what time, and how often.

What Is a DNS Leak?

A VPN creates an encrypted tunnel between your device and a remote server: your public IP address becomes the VPN’s, and your ISP can no longer see your traffic. But if your DNS queries don’t go through that tunnel, your ISP continues to receive the list of domains you visit in real time.

In other words: the website thinks you’re in another country, while your ISP continues to track every site you visit. This is only partial privacy, which negates much of the point of using a VPN.

Most Common Causes

• The VPN doesn’t handle DNS. Some VPNs (especially free or poorly configured ones) only tunnel web traffic and leave DNS handling to the system.
• IPv6. If the VPN only routes IPv4, IPv6 queries escape the tunnel.
• Smart Multi-Homed Name Resolution (Windows). Windows can query multiple DNS servers simultaneously and use the fastest response, even if it’s from the ISP.
• ISP DNS hijacking. Some providers redirect your queries even if you’ve manually configured a different DNS server.
• Network changes. When switching from Wi-Fi to mobile data, or when reconnecting, the system may revert to the router’s DNS.

How to Check for a DNS Leak

The test is simple and free:

1. Connect to your VPN as you normally would.
2. Open net-analyzer.com in your browser and run the privacy scan, which includes a DNS leak test as well as checks for public IP, WebRTC, and headers.
3. See which DNS servers appear in the results.

Quick interpretation:

• If servers from your ISP or your actual country appear, there’s a leak.
• If only the VPN’s own DNS servers or those of the provider you configured (Cloudflare, Quad9, etc.) appear, you’re protected.

It’s a good idea to repeat the test with the VPN turned off and on to compare results, and also when switching from Wi-Fi to mobile data.

How to fix a DNS leak

1. Enable your VPN’s leak protection. Most VPNs call this “DNS leak protection” or “private DNS”; it should be enabled by default.
2. Manually configure a neutral DNS server on your device or router so that queries don’t rely on your ISP even if the VPN fails.
3. Use encrypted DNS (DoH/DoT) when available: the query travels encrypted, and the ISP cannot easily read or intercept it.
4. Disable IPv6 if your VPN doesn’t support it, to prevent queries from leaking through that channel.

Common public DNS servers

What to Look for in a VPN to Avoid These Issues

• Own DNS servers and resolution within the tunnel.
• Full IPv6 support or explicit blocking.
• Kill switch, so that a VPN outage doesn’t expose your real DNS.
• A verifiable—and, better yet, audited—no-logs policy.

Conclusion

A DNS leak turns a VPN into a disguise with holes: your IP address changes, but your ISP can still see where you’re going. The good news is that it takes just two minutes to check for this using a test like Net-Analyzer’s, and fixing it usually involves enabling a setting or manually changing your DNS.