What a DNS leak is

A DNS leak happens when your device sends DNS queries outside your VPN tunnel — usually to your ISP — revealing:

• The websites you visit
• Your browsing patterns
• Your approximate location

Even if your IP is hidden, DNS leaks expose your activity.

2. Why DNS leaks matter

DNS leaks can compromise:

• Privacy — your ISP or other intermediaries can see what domains you access
• Security — leaked DNS requests can be intercepted or manipulated
• Anonymity — websites and trackers can correlate DNS data with your identity

What the DNS leak test does?

The test checks:

• Which DNS server is responding to your queries
• Whether it belongs to your ISP, a third party, or your VPN
• Whether your DNS traffic is protected inside the VPN tunnel

If the test shows your ISP’s DNS servers, you have a leak.

Common causes of DNS leaks

NordVPN typically lists:

• Misconfigured network settings
• OS‑level DNS overrides
• Browser DNS (like Chrome’s secure DNS) bypassing the VPN
• VPN dropouts
• Smart DNS or proxy services running in parallel

How NordVPN prevents DNS leaks

They highlight:

• Kill switch to block traffic if the VPN drops
• Encrypted DNS inside the VPN tunnel
• Private NordVPN DNS servers
• Automatic DNS leak protection in the app

What to do if you have a leak

• Restart the VPN
• Disable “Secure DNS” in browsers
• Flush DNS cache
• Ensure no custom DNS is set on your OS/router
• Use NordVPN’s app instead of manual configuration

How to fix and prevent DNS leaks

Run a DNS leak test with your VPN connected

Start Here

You need to confirm whether DNS requests are actually leaking before changing settings.

Connect to your VPN → Open a DNS leak test site (e.g., NordVPN DNS leak test) → Run the test

• Make sure your VPN is ON before testing
• Note which DNS servers appear (ISP vs VPN/provider)
• If you see your ISP’s DNS, you have a leak

Enable DNS leak protection in your VPN app

Most Common Fix

Many leaks are fixed simply by forcing the VPN to use its own DNS servers.

Open your VPN app → Settings/Preferences → Security/Advanced

• Look for options like “Use VPN DNS”, “DNS leak protection”, or “Force all traffic through VPN”
• Enable the kill switch if available
• Disconnect and reconnect the VPN after changing settings

Lock down DNS on Windows 10/11

Windows may keep using local or ISP DNS even when the VPN is active.

Settings → Network & Internet → Advanced network settings → More network adapter options

• Right‑click your active adapter → Properties
• Select Internet Protocol Version 4 (TCP/IPv4) → Properties
• Choose Use the following DNS server addresses and set trusted DNS (e.g. 1.1.1.1 / 1.0.0.1 or your VPN’s DNS)
• Optionally disable IPv6 if your VPN doesn’t support it
• Open Command Prompt and run: ipconfig /flushdns

Lock down DNS on macOS

macOS can leak when custom DNS or Wi‑Fi profiles override your VPN’s DNS.

System Settings → Network → Select active connection → Details → DNS

• Remove old or ISP DNS entries
• Add trusted DNS (e.g. 1.1.1.1, 1.0.0.1, or your VPN’s DNS)
• Click OK → Apply
• Open Terminal and run:
  • sudo dscacheutil -flushcache
  • sudo killall -HUP mDNSResponder

Fix DNS leaks on iOS and Android

Mobile devices may bypass VPN DNS via Wi‑Fi profiles or private DNS settings.

Open VPN app → Settings; then check system network/DNS settings

• In your VPN app, enable Use VPN DNS or DNS leak protection if available
• On Android: Settings → Network & Internet → Private DNS → set to Off or to a trusted provider that matches your VPN
• On iOS: remove custom DNS profiles or configuration profiles that set DNS
• Reconnect Wi‑Fi, then reconnect the VPN

Configure router DNS to avoid leaks

Important for Home Networks

If your router forces ISP DNS, devices may leak even with a VPN.

Log into router admin (often http://192.168.1.1 or similar) → DNS/Internet settings

• Replace ISP DNS with trusted DNS (e.g. Cloudflare 1.1.1.1 / 1.0.0.1, or Google 8.8.8.8 / 8.8.4.4)
• If supported, enable DNS over HTTPS (DoH) or DNS over TLS (DoT)
• Save and reboot the router
• Avoid mixing Smart DNS/proxy services with your VPN unless you know the routing behavior

Re‑test for DNS leaks and verify

Confirm Fix

You only know it’s fixed when the test shows VPN or trusted DNS instead of ISP DNS.

Reconnect VPN → Open DNS leak test site → Run test again

• Confirm that DNS servers now belong to your VPN or chosen DNS provider
• If ISP DNS still appears, re‑check:
  • VPN connection status
  • Manual DNS settings on the device
  • Router DNS configuration
• Repeat until no ISP DNS servers show in the results