How to fix a DNS leak

Before you change anything

Run the DNS leak test with the VPN connected and write down every resolver operator it shows. Then check your VPN provider's documentation for the resolver it uses. A resolver belonging to an unfamiliar company may be the provider's partner, so confirm it is really unexpected before changing settings. If the test returned no result, run it again: an incomplete test is not evidence either way.

Change one setting at a time and re-run the test after each change, so you know which change fixed it.

Step 1: Check your VPN app

• Update the app to the latest version.
• Look for a setting called DNS leak protection, "use VPN DNS" or similar, and turn it on.
• If the app lets you set custom DNS, clear it to use the provider's default while you troubleshoot.
• Turn on IPv6 leak protection if offered, or check that the app supports IPv6.
• Disconnect, reconnect, and test again.

Step 2: Check your browser's secure DNS

Many browsers can send lookups to their own chosen resolver over DNS over HTTPS, separately from the VPN. That is not necessarily a leak, but it will show a different resolver. Menu names vary between versions:

• Chrome and Brave: Settings, Privacy and security, Security, "Use secure DNS".
• Edge: Settings, Privacy, search and services, Security, "Use secure DNS".
• Firefox: Settings, Privacy and Security, "DNS over HTTPS".

While you troubleshoot, set Chrome, Edge and Brave to use your current service provider rather than a named provider such as Cloudflare or Google, and turn DNS over HTTPS off in Firefox. That lets the VPN's resolver handle lookups. Re-run the test, then switch secure DNS back on afterwards if you want it.

Step 3: Remove manual DNS on the device

A DNS server typed into your network settings can override what the VPN provides. Check these places:

• Windows 11: Settings, Network and internet, your Wi-Fi or Ethernet connection, Hardware properties, "DNS server assignment". Set it to Automatic (DHCP) while testing.
• macOS: System Settings, Network, your connection, Details, DNS. Remove manually added servers that appear in black text.
• iPhone and iPad: Settings, Wi-Fi, the (i) beside your network, Configure DNS. Set it to Automatic.
• Android: Settings, Network and internet, Private DNS. Try Automatic or Off while testing. The location varies by manufacturer.

Step 4: Check IPv6 and split tunnelling

If your VPN does not support IPv6 and the IPv6 check reaches the internet while connected, IPv6 lookups may be bypassing the tunnel. Use the app's IPv6 protection first. Turning IPv6 off on the network adapter is a last resort, and you should note how to turn it back on.

Also check the app's split-tunnelling list. If your browser is excluded, its lookups use your normal connection by design.

Step 5: Clear the DNS cache and reconnect

Cached answers can make old settings appear to linger. After changes, disconnect the VPN, clear the cache, reconnect and test:

• Windows: open Command Prompt and run ipconfig /flushdns
• macOS: in Terminal, run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
• Phones: turn airplane mode on for a few seconds and then off again. This clears most cached lookups. Restarting the phone also works.

If the leak remains

Contact your VPN provider's support team with the resolver names the test showed, your device and operating system, the app version and the protocol you use. Leave your home IP address out of public posts. Providers can confirm whether a resolver belongs to them and whether your setup needs a specific setting.

On a work or school device, DNS is often managed by the organization on purpose. Do not change or disable those controls without the administrator's permission.

What success looks like

Repeated tests show only the resolver your VPN documents, or the one you deliberately chose, and that result holds after reconnecting, after sleep and after switching networks. That is much stronger evidence than a single clean run. Retest whenever you update the VPN app or change browser settings.