DNS leaks: what they are and how to fix them on Windows, macOS, iOS, Android and Linux

What leaks, exactly

Before your browser opens a site it asks a DNS resolver for the site’s address. With a VPN on, that question should go through the tunnel to a resolver chosen by the VPN. If it goes to your ISP’s resolver instead, your ISP sees every name you look up, and some sites can tell that your resolver and your exit address are in different places. Nothing else about the tunnel has to be broken for this to happen.

How to tell

Run a leak test with the VPN connected. A pass shows a resolver operated by your VPN provider (or a public resolver you chose on purpose) in or near the VPN’s country. A leak shows your ISP’s name or a resolver in your home country.

Fix it in the VPN first

Most VPN apps have a setting named something like “use VPN DNS”, “DNS leak protection” or “block non-VPN DNS”. Turn it on, reconnect and test again. That covers every app on the device at once.

Or set the resolver per operating system

Windows

Microsoft documents per-network DNS settings: open Settings, Network & Internet, choose the adapter, then DNS settings › Edit, switch to Manual and enter the DNS servers. If the servers are on Windows’ list of known DNS-over-HTTPS servers you can choose “Encrypted only (DNS over HTTPS)” or “Encrypted preferred, unencrypted allowed”.^[1] Microsoft warns that the second option falls back to plain DNS without telling you.

macOS

In System Settings › Network, select the active service, open Details › DNS, and replace the servers your router supplied. In Terminal, scutil --dns lists which resolvers are in use for which domains, which is handy for spotting a leftover ISP resolver.

iOS and iPadOS

For a Wi-Fi network: Settings › Wi-Fi › the ⓘ next to the network › Configure DNS › Manual. Mobile data has no manual DNS setting; rely on the VPN app’s DNS option or an encrypted-DNS profile from a resolver you trust.

Android

Settings › Network & internet › Private DNS, with the options Off, Automatic and “Private DNS provider hostname”.^[2] Google notes that Private DNS “helps secure only DNS questions and answers”. A named provider sends lookups there even with a VPN on, which avoids the ISP but bypasses the VPN’s own resolver.

Linux

On distributions using systemd-resolved, resolvectl status shows the DNS servers per interface. The VPN’s interface should carry its DNS servers and be the default route for lookups; if the physical interface still lists your ISP’s resolver as default, your VPN client is not integrating with resolved. Many VPN clients have a setting or plug-in for this.

Browsers with their own DNS

Firefox can use its own encrypted resolver (Trusted Recursive Resolver). In “TRR first” mode it uses DNS over HTTPS and falls back to the system resolver only when a lookup fails; “TRR only” never falls back.^[3] Chrome and Edge have a similar secure-DNS option. When these are on, the browser’s lookups go to that provider rather than the VPN’s resolver: not a leak to your ISP, but a third party you should choose deliberately.

The other leak worth checking

DNS is one of four checks. WebRTC, the browser feature behind video calls, can reveal network addresses; the IETF’s handling rules discuss the privacy cost for VPN users specifically.^[4] Run the full check once after any fix.

Sources

1. Secure DNS Client over HTTPS (DoH) · Microsoft LearnChecked 5 Oct 2026
2. Manage advanced network settings on your Android phone (Private DNS) · Google Android HelpChecked 5 Oct 2026
3. Trusted Recursive Resolver (network.trr.mode) · Mozilla WikiChecked 5 Oct 2026
4. RFC 8828: WebRTC IP Address Handling Requirements (Jan 2021) · IETF / RFC EditorChecked 5 Oct 2026