DNS leaks: what your "phone book" lookups reveal about you

The short version

Every time you visit a website, your device quietly asks a "phone book" server to look up that site's address. That lookup is called DNS. If those lookups go to the wrong place, whoever runs that phone book can see a list of every site you visit. A DNS leak means your lookups are escaping to a server you didn't intend, often your internet provider, even when you think a VPN is hiding you.

What's actually happening

Imagine you want to mail a lot of letters, but you don't know anyone's street address. So you phone a directory service and read out each name: "Where does my bank live? Where does this news site live?" The directory writes down every name you ask about.

That directory service is DNS. The problem isn't that the letters get opened. It's that the directory keeps a record of every name you looked up. If you're using a VPN (a service that hides where your internet traffic comes from), you probably assume those lookups go through the VPN too. A leak means they sneak out the side door to your internet provider's directory instead. Your provider can't read the pages you load, but it can see the name of every site, which is often enough to know a lot about you.

Why it matters to you

• Your internet provider can build a list of every website you visit, even with a VPN running.
• On public Wi-Fi, a stranger on the same network may be able to see or tamper with your lookups.
• It quietly undoes the privacy you may be paying a VPN for.

A DNS leak doesn't expose your passwords or the contents of your messages. It exposes the list of places you go. That's the honest scope of it.

How to fix it

There are two good moves. If you use a VPN, start with step 1. If you don't use a VPN, skip to step 2 to turn on encrypted DNS, which hides your lookups from your provider and from strangers on the same network.

1. Turn on your VPN's leak protection

1. Open your VPN app and go to its Settings.
2. Look for DNS leak protection, Use VPN DNS, or similar, and turn it on. Most good apps have this on already.
3. If the app has a Kill Switch, turn it on too. It blocks the internet if the VPN drops, so nothing leaks.

2. Turn on encrypted DNS on your device

Windows 11:

1. Open Settings and go to Network & internet.
2. Click your Wi-Fi or Ethernet connection, then find DNS server assignment and click Edit.
3. Switch to Manual, turn on IPv4, and type a private DNS server (for example Cloudflare's 1.1.1.1 or Quad9's 9.9.9.9).
4. Set the DNS over HTTPS box to On (automatic template), then click Save.

Android (version 9 and newer):

1. Open Settings, then Network & internet (on some phones it's Connections).
2. Tap Private DNS.
3. Choose Private DNS provider hostname and type dns.quad9.net or one.one.one.one, then Save.

iPhone or iPad: Apple has no simple switch for this. The easiest path is to install a trusted app like Cloudflare 1.1.1.1 or NextDNS from the App Store and follow its one-tap setup.

3. In your web browser (optional)

Browsers have their own DNS setting. If you use a VPN, it's usually best to turn the browser's version off so everything goes through the VPN. If you don't use a VPN, leaving it on adds privacy.

• Chrome / Brave: Settings → Privacy and security → Security → Use secure DNS.
• Edge: Settings → Privacy, search, and services → Security → Use secure DNS.
• Firefox: Settings → Privacy & Security → scroll to DNS over HTTPS.
• Safari: has no such setting; it follows whatever your Mac or iPhone uses.

How to check it worked

Come back and run the DNS leak test on this site (turn on your VPN first if you use one). You want to see only your VPN's or your chosen provider's servers in the results, not your home internet provider's name. If your provider no longer shows up, you've fixed it.

If your result was already good

If this test passed, your lookups are already going where they should. You don't need to change anything. Just keep your VPN app updated, and if you switch Wi-Fi networks a lot, it's worth re-running this test once on a new network to be sure the good result follows you.

Want to go further?

Switch to the Advanced version of this guide for the difference between DoH and DoT, how to stop apps from hard-coding their own DNS, and how to lock this down for your whole home at the router.

What a DNS leak actually is

A DNS leak is any DNS resolution that exits a path you believe is private, revealing your query stream (and often your real IP as the query source) to an unintended resolver, typically your ISP. The payloads of your connections stay encrypted by TLS, but DNS metadata, the FQDN of every host you contact, is a high-value behavioral record. On a VPN, a leak defeats much of the point: the tunnel carries your packets, but your resolver traffic takes a different route.

Why leaks happen

• Split-DNS / OS resolver behavior. Windows in particular has used "smart multi-homed name resolution," sending queries out every interface in parallel and racing the answers. That can send lookups down the physical NIC instead of the tunnel.
• Browser DoH overriding the system. Chrome, Edge, Firefox and Brave can resolve via their own DoH endpoint, bypassing both the OS resolver and the VPN's pushed DNS. Useful by design, a leak by accident when a VPN is active.
• Apps with hard-coded resolvers. Some software queries 8.8.8.8 or a baked-in DoH server directly, ignoring system settings entirely.
• IPv6 escape. A VPN that only captures IPv4 while the OS still has working IPv6 will leak AAAA lookups and IPv6 traffic outside the tunnel.
• Misconfigured VPN. No DNS push, no leak protection, or a dropped tunnel with no kill switch.

Encryption vs. destination, two separate problems

Encrypting DNS and controlling who resolves it are different goals, and conflating them causes bad configurations.

• DoH (DNS over HTTPS, RFC 8484) wraps queries in HTTPS on 443, blending with web traffic and resisting on-path inspection and blocking.
• DoT (DNS over TLS, RFC 7858) uses a dedicated TLS session on port 853, easier for a network to identify and block but equally confidential. Android's "Private DNS" is DoT.

Encryption hides the query from the network in transit; it does nothing about the resolver operator, who still sees everything. If you run a VPN, the correct posture is usually unencrypted DNS pushed to the VPN's internal resolver inside the tunnel (confidential because it's inside the tunnel), with browser DoH disabled so it can't override that. If you have no VPN, DoH/DoT to a resolver you trust (and whose logging policy you accept) is the privacy win.

Fixes by layer

VPN client

• Enable DNS leak protection / "use VPN DNS only" and a kill switch (firewall-based lockdown).
• Ensure IPv6 is either tunneled or disabled by the client; many clients offer "block IPv6" to prevent AAAA leaks.
• For WireGuard configs, confirm DNS = is set and that AllowedIPs covers 0.0.0.0/0 and ::/0 for a full tunnel.

Operating system

• Windows 11: Settings → Network & internet → (adapter) → DNS server assignment → Edit → Manual → set servers and DNS over HTTPS = On (automatic template). Modes: unencrypted only, encrypted only (no fallback), or encrypted preferred. Choose "encrypted only" for a fixed machine, "encrypted preferred" for a roaming laptop that hits captive portals. To kill the multi-homed race, set the Group Policy Turn off smart multi-homed name resolution (or the DisableSmartNameResolution registry value).
• macOS: no Settings toggle for DoH. Install a DNS configuration profile (.mobileconfig with a com.apple.dnsSettings.managed payload) to set a system-wide encrypted resolver; several providers (Cloudflare, NextDNS, Quad9) ship signed profiles.
• iOS/iPadOS: same profile mechanism, or a NetworkExtension app (Cloudflare 1.1.1.1, NextDNS) that installs a system-wide encrypted resolver.
• Android 9+: Settings → Network & internet → Private DNS → provider hostname (DoT). Note this is bypassed by an active VPN app that sets its own DNS.

Browsers

• Chrome/Brave/Edge: Security settings → "Use secure DNS." With a VPN, turn it off so the tunnel's resolver wins. Without a VPN, set a specific provider rather than "with your current service provider."
• Firefox: Privacy & Security → DNS over HTTPS → Off / Default / Increased / Max Protection. about:config keys: network.trr.mode (0 off, 2 DoH-with-fallback, 3 DoH-only, 5 explicitly off) and network.trr.uri for the endpoint.

Router (household-wide)

Set your upstream resolvers in the router's DHCP/WAN DNS fields so every device inherits them. Only firmware with a DoH/DoT forwarder (OpenWrt with https-dns-proxy or stubby, pfSense/OPNsense with Unbound+DoT, or stock firmware that supports it) encrypts the upstream hop; otherwise you've only centralized plaintext DNS. Pair with "DNS rebinding protection" and, ideally, force all LAN clients to the router by intercepting outbound port 53.

Verification

• Run a browser-based DNS leak test (extended/multi-query) with and without the VPN. You should see only the intended resolver(s) and no ISP ASN.
• CLI spot checks: Resolve-DnsName -DohOnly on Windows to confirm DoH works; resolvectl status / resolvectl query on Linux; scutil --dns on macOS to see per-interface resolvers.
• Test IPv6 explicitly, request an AAAA record and confirm it resolves through the tunnel, not the WAN.
• Edge case: transparent DNS proxying by the ISP (hijacking port 53) can make plaintext DNS appear to go to your chosen server while the ISP still answers. DoH/DoT defeats this; a leak test that reports an unexpected resolver confirms it.

What this does and does not hide

Fixing DNS leaks hides your query stream from the network and your ISP. It does not hide the destination IPs of your connections (visible once the TCP/QUIC session opens), the SNI in the TLS handshake (unless Encrypted Client Hello is negotiated end to end), or your traffic from the resolver operator you chose. Pick a resolver whose logging and jurisdiction you're comfortable with, because you're trusting them with exactly what you took away from your ISP.