A DNS leak is the quietest way a VPN fails. The app says connected, an IP checker shows the server's address, and your DNS queries are still going to your ISP's resolver — which means a complete list of every domain you visited is sitting on someone else's infrastructure.
Why it happens
Your operating system has DNS servers configured independently of your VPN. When the VPN connects it is supposed to override them and route lookups through the tunnel. Several things break that: a client that defaults to "use my system DNS", an IPv6 lookup escaping an IPv4-only tunnel, or a browser making its own resolver requests.
The five-minute test
- Disconnect the VPN. Note your public IP and the DNS servers your system reports.
- Connect to a VPN server in a country you do not live in.
- Load a DNS leak test site and run the extended test, not the standard one.
- Compare the results. Every resolver listed should belong to your VPN provider or their DNS partner. Your ISP appearing anywhere at all is a fail.
- Repeat with IPv6 enabled, then again with your browser at default WebRTC settings. These are three separate leak paths and they fail independently.
Fix one: force the provider's DNS
Open your VPN client settings and find the DNS option. A surprising number of clients ship with "use my system DNS" enabled by default. Switch it to the provider's own resolvers and re-test.
Fix two: disable IPv6
If your provider does not explicitly support IPv6 tunnelling, a dual-stack connection will route IPv6 traffic outside the tunnel entirely. Disable IPv6 at the operating system level — network adapter properties on Windows, or the network service configuration on macOS — and re-test.
Fix three: block WebRTC
WebRTC lets browsers discover your local network addresses for peer connections, and that discovery can reveal your real IP even through a working tunnel. Disable WebRTC in your browser settings or install an extension that blocks local candidate discovery.
Run the test again after a forced network drop, not just after a clean connect. That is where kill switches fall over.
If it still leaks, the provider is at fault
Use the refund window. We have never seen a provider argue with a refund request that arrived with leak test screenshots attached. Every provider in our current top ten passed all four leak tests on three operating systems, so a persistent leak means you are on the wrong product.
If you want one that is verifiable rather than merely audited, Proton VPN publishes open-source clients — we built the Linux app from source and matched the published hash — and it passed every leak test in our July cycle.
