How to Detect and Fix DNS Leaks

A DNS leak is one of the most common ways a VPN can fail without you knowing. Here's what it is, how to test for it, and how to fix it.

What is a DNS Leak?

DNS (Domain Name System) is the "phonebook" of the internet — it translates domain names like google.com into IP addresses. Every time you visit a website, a DNS query is made.

When you're connected to a VPN, those queries should go through the VPN's encrypted tunnel to the VPN's DNS servers. A DNS leak happens when those queries bypass the tunnel and go directly to your ISP's DNS servers instead — exposing every site you visit.

Why DNS Leaks Happen

• The VPN client doesn't override the system DNS settings
• IPv6 traffic bypasses the VPN tunnel
• Windows's "Smart Multi-Homed Name Resolution" sends DNS to multiple resolvers simultaneously
• VPN connection drops briefly, and DNS defaults revert

How to Test for DNS Leaks

The easiest way is to use our IP Leak Test tool. It checks your public IP and can help identify if your traffic is being routed outside the VPN.

You can also use third-party tools like dnsleaktest.com — connect to your VPN, run the extended test, and check whether the DNS servers shown belong to your VPN or your ISP.

How to Fix a DNS Leak

1. Use a VPN with built-in DNS leak protection — CyberCat routes all DNS queries through our own servers by default
2. Enable IPv6 leak protection — IPv6 traffic can bypass VPN tunnels; disable IPv6 or use a VPN that handles it
3. Use a kill switch — this blocks all traffic if the VPN connection drops, preventing your real IP from ever being exposed
4. Manually set DNS servers — configure your network adapter to use a privacy-respecting resolver

Prevention is Better Than Cure

A quality VPN should handle DNS leak prevention automatically. When evaluating a VPN, look for explicit mentions of DNS leak protection and kill switch functionality. Run a leak test after connecting to any new VPN to verify it's working as expected.