DNS leaks: what they reveal, how to test, and why a VPN alone is not enough

A VPN can hide your IP while your DNS queries still go to a local resolver. Here is what that reveals and how to check it.

What a DNS leak is

When you visit a domain, your device asks a DNS resolver to translate it into an IP. If those queries go to a resolver operated by your ISP — or one in your real country — while your web traffic goes through a VPN, you have a DNS leak.

Why it matters

Platforms and anti-fraud vendors compare signals:

• The resolver's country vs your IP's country.
• The resolver operator (ISP DNS vs a public resolver).
• Whether the resolver is one your ISP would normally assign.

A mismatch is a strong hint that the network path is being tunnelled — even when the IP looks perfect.

How to test

1. Resolver country — public DNS leak testers show which resolvers answered.
2. Consistency — repeat the test at different times; VPN split tunnels leak intermittently.
3. Browser-level checks — some browsers use DNS-over-HTTPS by default, which can mask the leak or create a different mismatch.

What to fix

• Route DNS through the same path as your traffic (VPN-provided DNS, or a resolver in the same country).
• Disable "smart DNS" features that rewrite resolvers per-domain.
• Check after every network change; the leak often appears only on some hosts.

What this does not fix

A clean DNS path does not fix a mismatched timezone, language, or browser fingerprint. Those are separate checks — our fingerprint panel shows what your browser exposes.