---
title: "WireGuard DNS Explained: AllowedIPs, DNS=, and Leaks"
url: "https://astraguardvpn.com/blog/wireguard-dns-explained-allowedips-leaks"
description: "WireGuard DNS configuration guide: DNS=, AllowedIPs, full tunnel, and how to prevent WireGuard DNS leaks."
updated: "2026-07-23T00:42:22.508Z"
---

# WireGuard DNS Explained: AllowedIPs, DNS=, and Leaks

WireGuard is fast, but DNS depends on how you set DNS= and AllowedIPs. Misconfig equals leaks.

WireGuard is fast, but DNS depends on how you set DNS= and AllowedIPs. Misconfig equals leaks. How WireGuard handles DNS WireGuard itself is a layer-3 tunnel. The DNS= field tells the client which resolvers to use while the interface is up. If omitted, the OS keeps using ISP DNS — a classic leak. AllowedIPs and routing AllowedIPs = 0.0.0.0/0, ::/0 is full tunnel. Narrower ranges create split tunnel; DNS for excluded destinations may leave the VPN path. Common WireGuard DNS mistakes Empty DNS= Conflicting multiple tunnels Mobile OS ignoring DNS= after sleep IPv6 left outside AllowedIPs Recommended setup Use AstraGuard WireGuard configs as provided, keep full tunnel for privacy sessions, and verify DNS after every reconnect. See VPN protocols explained . Testing After handshake, confirm handshake time recent, IP is VPN, DNS resolvers are VPN, and no ISP IPv6. Example minimal peer thinking A privacy-focused peer usually needs: a single VPN endpoint, AllowedIPs covering default routes, and a non-empty DNS= pointing at the provider resolver. Missing any one of those three is how WireGuard “works” while still leaking DNS. Mobile sleep caveat Phones may rebuild network namespaces after doze. Always re-check DNS after the device sleeps on a new SSID. Protect yourself with AstraGuard VPN AstraGuard VPN helps keep DNS inside the tunnel with strong encryption, kill switch options, and simple setup on desktop and mobile. Create an account , pick a plan on packages , then verify on privacy tools .

---

[More articles](https://astraguardvpn.com/blog) · [VPN plans](https://astraguardvpn.com/packages)