A DNS leak is the most common way a VPN quietly fails. The tunnel is up, your IP address checks out, and your DNS queries are still going to your ISP — which means there is a full list of every domain you visited sitting on someone else's resolver.

We test every provider for this, and in the last three cycles we have found leaks in eight of them. Here is the check, so you can run it yourself.

The five-minute test

  • Disconnect the VPN. Note your public IP and the DNS servers your system reports.
  • Connect to a VPN server in a country you do not live in.
  • Load a DNS leak test site and run the extended test, not the standard one.
  • Compare: every resolver listed should belong to the VPN provider or their DNS partner. Your ISP appearing anywhere is a fail.
  • Repeat with IPv6 enabled, then with your browser's WebRTC left at default. These are separate leak paths and they fail independently.
Source code on a monitor
Run the extended test, not the standard one — the short version misses secondary resolvers.
Run the test after a forced network drop, not just after a clean connect. That is where kill switches fall over.

The three fixes that resolve most leaks

First, turn on the provider's own DNS handling if it is optional — a surprising number of clients ship with "use my system DNS" as a default. Second, disable IPv6 at the operating system level if your provider does not explicitly support IPv6 tunnelling; a dual-stack connection with an IPv4-only VPN will route half your traffic outside the tunnel. Third, disable WebRTC in the browser or install an extension that blocks the local candidate discovery.

If a leak persists after all three, the provider is at fault and you should use the refund window. We have never had a provider argue with a refund request that came with leak test screenshots attached.

The kill switch test people skip

Most leak testing happens on a stable connection, which is the easy case. The interesting case is the moment the tunnel drops. Our procedure is to start a continuous ping, forcibly kill the VPN process, and watch whether any packets reach the destination before the kill switch engages. We run this 40 times per provider. The good ones leak zero packets. The bad ones leak for two to three seconds — long enough for a browser tab to phone home.