---
title: "DNS Leak Explained: How Your VPN Can Still Expose You"
url: "https://astraguardvpn.com/blog/dns-leak-explained-how-vpn-exposes-you"
description: "What a DNS leak is, why VPNs fail, how to test, and how AstraGuard VPN blocks DNS leaks."
updated: "2026-07-13T00:42:22.494Z"
---

# DNS Leak Explained: How Your VPN Can Still Expose You

A DNS leak sends domain lookups outside the VPN tunnel. Learn how it happens, what it reveals, and how to stop it.

A DNS leak sends domain lookups outside the VPN tunnel. Learn how it happens, what it reveals, and how to stop it. What is a DNS leak? DNS (Domain Name System) turns names like example.com into IP addresses. When you use a VPN, those lookups should travel inside the encrypted tunnel to the VPN provider's resolver. A DNS leak happens when queries skip the tunnel and go to your ISP, employer, hotel, or public Wi‑Fi DNS instead. Why DNS leaks matter for privacy Even if your web traffic is encrypted, DNS queries reveal which sites you visit and when. ISPs, captive portals, and local network admins can build a browse timeline from leaked DNS alone. For journalists, travelers, and anyone avoiding ISP profiling, a DNS leak undoes much of the VPN's value. Common causes of DNS leaks OS still using ISP or router DNS after VPN connect IPv6 DNS used while the VPN only covers IPv4 Browser Secure DNS / DoH pointing outside the VPN Split tunneling sending some apps outside the tunnel Misconfigured OpenVPN dhcp-option DNS or WireGuard DNS= Android Private DNS set to a third-party resolver How to test for a DNS leak Note your real IP and ISP without VPN (use our tools page ). Connect to AstraGuard VPN. Open a DNS leak test and confirm resolvers match the VPN, not your ISP. Repeat after switching networks (home → café → mobile hotspot). Retest in each browser you use daily. How to fix DNS leaks Prefer a VPN that forces DNS through the tunnel. On OpenVPN, ensure the profile pushes VPN DNS. On WireGuard, set DNS= to the provider resolver and avoid conflicting system DNS. Disable unused IPv6 if your tunnel is IPv4-only. Align browser DoH with the VPN or turn it off while testing. AstraGuard routes DNS through encrypted servers by default to reduce this class of leak. SEO checklist: keywords this guide covers dns leak, dns leak test, vpn dns leak, fix dns leak, prevent dns leak, isp dns, encrypted dns, vpn resolver. DNS leak FAQ Can HTTPS stop DNS leaks? No. HTTPS encrypts the HTTP session after DNS resolves. The lookup itself can still go to your ISP if it leaves the VPN tunnel. Is DoH the same as VPN DNS? No. DNS over HTTPS encrypts DNS to a DoH provider. A VPN DNS path sends lookups through the tunnel to the VPN resolver. They solve different trust problems. How often should I retest? After OS updates, browser updates, new Wi‑Fi networks, and any change to split tunneling. A monthly baseline test is a healthy minimum. Related AstraGuard pages Continue with the DNS leak test guide , privacy tools , and kill switch documentation. Protect yourself with AstraGuard VPN AstraGuard VPN helps keep DNS inside the tunnel with strong encryption, kill switch options, and simple setup on desktop and mobile. Create an account , pick a plan on packages , then verify on privacy tools .

---

[More articles](https://astraguardvpn.com/blog) · [VPN plans](https://astraguardvpn.com/packages)