A DNS leak means your browser is sending "what website am I about to visit?" queries to your ISP even though the rest of your traffic goes through a VPN or proxy. Your ISP (and anyone with subpoena power over your ISP's logs) sees your full browsing list. The VPN hides the data on the pipe; the DNS leak leaks the destination.
This guide explains what's actually happening, how to test in 60 seconds, and how to plug the leak on every major operating system.
DNS (Domain Name System) is the internet's phone book. When you type example.com, your device first asks a DNS server "what IP address is example.com?" Only after getting the answer does it open a connection. Every website, app, and background service does this — typically hundreds of DNS queries per hour per device.
The question is which server you're asking. By default it's your ISP's. Comcast's DNS sees every site Comcast customers visit. T-Mobile's sees every site T-Mobile customers visit. This log is retained for months to years in many countries.
A VPN encrypts your network traffic and routes it through a VPN server. If the VPN is configured correctly, your DNS queries also go through the tunnel — to the VPN provider's DNS server or a privacy-focused one like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9).
A leak occurs when the DNS query bypasses the tunnel and goes to your ISP anyway. Common causes:
-proxy-remote-dns flag in Chrome, or DNS_REMOTE in curl), your ISP still sees every hostname.The fastest check is a DNS leak test site. The best ones in 2026:
How to read the result:
1.1.1.1 and 1.0.0.1 (Cloudflare) or 9.9.9.9 (Quad9)2606:4700:4700::1111) to matchSet-NetDnsClientNrptRule -Namespace . -DnsSecEnable $false to suppress multi-homed DNS1.1.1.1 and 2606:4700:4700::11111dot1dot1dot1.cloudflare-dns.com or dns.quad9.netChange your router's DNS to Cloudflare, Quad9, or NextDNS. This propagates to every device on the LAN and survives OS updates. Most home routers have the setting under WAN or Internet → Manual DNS.
chrome://settings/security--proxy-server="socks5://proxy:port" with --proxy-bypass-list="<-loopback>" and ensure DNS uses the proxy (Chrome does this by default for SOCKS5 with the h suffix)about:preferences#privacy → Enable DNS over HTTPS → Max Protectionabout:config → set network.proxy.socks_remote_dns to trueIf you're using a SOCKS5 proxy (common with SpyderProxy, curl, and most scraping setups), DNS resolution is local by default. Every hostname you resolve goes to your ISP before the connection even opens. The fix is application-level:
--socks5-hostname instead of --socks5proxies={"http": "socks5h://user:pass@proxy:port", "https": "socks5h://user:pass@proxy:port"} — the h suffix forces remote resolutionnetwork.proxy.socks_remote_dns = true--proxy-server="socks5://..." with a SOCKS5 URL (Chrome remote-resolves by default)Most consumer internet connections now carry IPv6 alongside IPv4. Apps prefer IPv6 when both are available. If your VPN only carries IPv4, every IPv6-capable service (Google, Facebook, Cloudflare-fronted sites) leaks over IPv6 directly.
Three fixes, best to worst:
Test the IPv6-specific leak at SpyderProxy IPv6 Checker.
Classic DNS is unencrypted plaintext — even if you point it at 1.1.1.1 instead of your ISP, your ISP can still see the queries in flight (just not modify them). DNS-over-HTTPS and DNS-over-TLS encrypt the queries themselves, hiding them from the ISP entirely.
In 2026, every major OS and browser supports DoH. Enable it. It's the single biggest privacy upgrade that takes zero technical expertise.
Three distinct leaks often confused:
about:config disable.A complete privacy posture needs all three plugged.
It's when your device secretly asks your ISP "what IP is example.com?" even though you're on a VPN. The VPN hides the traffic but the DNS question is already answered by your ISP — giving them a list of every site you visit.
Run any DNS leak test site while connected to your VPN. If the server shown matches your ISP (Comcast, Verizon, etc.), you have a leak. If it matches your VPN provider, Cloudflare, or Quad9, you're fine.
Directly, no — DNS leaks reveal domains visited, not names. Combined with your ISP's customer records, it reveals your full browsing history tied to your real identity.
No. Many free and mid-tier VPNs don't push DNS through the tunnel, especially for IPv6. Test after connecting to confirm.
Cloudflare (1.1.1.1) has the best no-logging audit record. Quad9 (9.9.9.9) adds malware blocking. NextDNS lets you configure filters yourself. Avoid Google DNS (8.8.8.8) if privacy is the goal.
By default, yes. SOCKS5 forwards the connection but local DNS resolution happens on your device first. Use socks5h:// URLs (the h means remote DNS) or set your app to resolve through the proxy.
Often, yes — modern browsers have their own DNS-over-HTTPS that can bypass OS settings. Check both your OS DNS config and your browser's secure-DNS setting.
They reveal different things. IP leak = target site knows you. DNS leak = ISP knows all the sites you visit. Both are worth fixing.
DNS leaks are the most common privacy gap on otherwise well-configured systems. Test once a month using SpyderProxy's DNS Leak Test, and keep DNS-over-HTTPS enabled on every device. If you're scraping or privacy-browsing through a SOCKS5 proxy, use the socks5h:// URL scheme so hostnames resolve remotely instead of through your ISP.