KiwiVPN
Privacy & networking · 3 min

DNS Leaks: What They Are and How to Test

Understand DNS leaks, test whether DNS requests use your expected resolver, and troubleshoot VPN settings without relying on a single test result.

A DNS leak is a situation where domain-name requests use a resolver or network path different from the one you expected—for example, when you believe DNS is being handled by your VPN but requests still reach a resolver outside the tunnel. A test can help identify a mismatch, but it should be interpreted in the context of your VPN, operating system, and network.

What a DNS test actually checks

When you open a domain, a DNS resolver returns records that help the device connect. A DNS leak test typically asks your browser to perform DNS lookups and reports the resolvers that answered. If the test lists your ISP’s resolvers while your VPN claims to route DNS through its service, investigate. However, the resolver’s company or geographic label can be imperfect, and the result does not automatically prove that someone has seen all your browsing history.

Why leaks or mismatches happen

  • The VPN app is not configured to handle DNS requests.
  • Split tunneling intentionally sends selected traffic outside the VPN.
  • The operating system retains a different DNS configuration or uses encrypted DNS through the browser.
  • IPv4 and IPv6 are handled differently by the VPN or network.
  • A corporate security agent, router, or local resolver changes the expected path.

How to test carefully

  1. Note your public IP and provider at the KiwiVPN checker.
  2. Connect your VPN and confirm that the public IP changes as expected.
  3. Use a reputable DNS leak test and record the resolver results, VPN state, browser, and time.
  4. Repeat after closing and reopening the VPN app; test once on Wi-Fi and, if useful, on mobile data.
  5. Compare the outcome with the VPN provider’s official explanation of its DNS design.

How to troubleshoot

Update the VPN app, enable its DNS protection or kill-switch options where appropriate, and review split-tunneling rules. On a managed work device, do not override company DNS settings without approval. If the issue remains, capture the test results without exposing personal details and contact the VPN provider. Disabling IPv6 indiscriminately is not the preferred first step; determine whether IPv6 is expected to pass through the tunnel and configure the product accordingly.

Important limits

A DNS test is a snapshot of the tested browser and network state. It cannot guarantee that every app on the device uses the same resolver, and it cannot prove that a VPN provider keeps no logs. A resolver location shown by a test may reflect routing or registration data rather than the actual physical location of a server.

Common questions

Does seeing my ISP’s name always mean a leak?

Not always. Check how the VPN handles DNS, whether split tunneling is enabled, and whether the test’s provider identification is reliable. A mismatch deserves investigation, not a dramatic conclusion from one label.

Can HTTPS prevent DNS leaks?

No. HTTPS protects the connection to a website, while DNS resolution occurs as a separate part of finding that website’s address.

Should I test with the VPN disconnected?

Yes, as a baseline. Then connect the VPN and compare the resolver and public IP results.

Read DNS explained, What a VPN changes, and IPv4 vs. IPv6.

Further reading

Browse all KiwiVPN guides or return to the public IP checker.