What is a DNS leak, and how do you fix one?

In plain English: before your device can open a website, it has to find out the website's number, its IP address. It does that by asking a DNS server, a sort of contacts list for the internet: you give it a name like example.com and it gives back a number. A DNS leak happens when your web traffic goes through a proxy or VPN but those name look-ups don't. They still go to your internet provider, which can then see a list of every site you visit. It's a common reason people think they're private when they aren't. This guide explains how leaks happen, how to spot one and how to fix it on Windows, on a Mac, on phones and in code.

Quick start in 3 steps

1. Switch your proxy or VPN on and run our DNS leak test.
2. If your own internet provider appears in the results, use the fix for your setup below.
3. Run the test again until only the resolvers you expect show up.

How DNS works, step by step

Opening a site always starts the same way: your device asks a DNS resolver (the server that answers name look-ups) to turn a readable name into an IP address. Only after that answer arrives does the real connection start. Out of the box, your device sends those questions to whatever resolver your network or provider set up, very often your provider's own.

A leak means two things are happening at once. Your connection goes through the proxy or VPN, so the pages themselves travel privately. Meanwhile your DNS questions, which reveal which sites you wanted, go straight to your provider in plain view. Anyone who can see those questions can follow your browsing, proxy or not.

Why leaks happen

A few usual suspects cause most of them:

• Names looked up on your own device. Some programs do the look-up themselves before handing the connection to the proxy, so the question never reaches the proxy.
• Fixed resolvers. Some apps and routers insist on one particular DNS server, whatever your proxy or VPN is doing.
• Operating system habits. Windows in particular can ask several resolvers at the same time, and some of them may sit outside your tunnel.
• IPv6 slipping past. IPv6 is the newer kind of internet address. A tunnel built only for the older IPv4 kind can let IPv6 look-ups leak out round the side.

Test before you trust

A leak is invisible until you look for one. With your proxy or VPN switched on, open our DNS leak test. It shows which DNS servers actually answered your look-ups. If you see your own provider's name, or resolvers in your home country where you expected the proxy's, you have a leak. Compare it with our my IP tool too. When the IP shows the proxy's location but DNS shows your real provider, that mismatch is the leak, plain to see.

The fix in code: let the proxy do the look-ups

If you write scripts, the cleanest fix is to hand name look-ups to the proxy. With a SOCKS5 proxy in Python, start the address with socks5h. The extra h stands for hostname and means the proxy looks names up for you:

import requests

proxies = {
    "http": "socks5h://USER:PASS@HOST:PORT",
    "https": "socks5h://USER:PASS@HOST:PORT",
}

r = requests.get("https://httpbin.org/ip", proxies=proxies, timeout=20)
print(r.json())

Plain socks5://, without the h, looks names up on your own device and leaks them. One letter makes the whole difference. With ordinary HTTP proxies the proxy usually does the look-ups for you, but run the test above to make sure.

The fix on Windows

1. Open Settings > Network & internet and choose your active connection.
2. Select Hardware properties. Next to DNS server assignment, press Edit.
3. Change it to Manual and enter a DNS service you trust instead of your provider's default.
4. Under Preferred DNS encryption, choose Encrypted (DNS over HTTPS) where it's offered, so any look-ups that do happen aren't sent as readable text.
5. If your tunnel doesn't handle IPv6, consider switching IPv6 off for that connection to stop IPv6 leaks.

The fix on a Mac

1. Open System Settings > Network, choose your connection and click Details.
2. Open the DNS tab.
3. Remove the servers your provider assigned and add a DNS service you trust under DNS Servers.
4. Click OK, then run the leak test again.

The fix on Android and iPhone

On Android, Settings > Network & internet > Private DNS lets you type in the hostname of a private DNS provider, which then encrypts look-ups for the whole phone. On an iPhone, you can install a configuration profile, or use an app, that sets up encrypted DNS. On both, switching aeroplane mode (airplane mode on some phones) on and off after changing settings makes the phone start using the new DNS service.

Check that the fix worked

After each change, run the DNS leak test again with the proxy switched on. You want to see only resolvers that belong to your proxy or to the private DNS service you picked, and none that lead back to your real provider or your real location. If a leak hangs on, the likely culprits left are IPv6 or an app with its own fixed resolver. Turn IPv6 off for the tunnel and look through that app's network settings.

Does the proxy type matter?

The type of proxy doesn't cause leaks, but it does affect how ordinary your setup looks once DNS is sorted. For traffic that should look like a normal home connection, residential proxies or residential premium work well with look-ups done by the proxy. For speed-first jobs, datacenter proxies are fine as long as DNS goes through them too. Browse every option on the proxies page. Once you're set up, run the proxy checker next to the leak test, so the exit address and the DNS route are both confirmed in one go.

Is this allowed?

Changing the DNS settings on your own phone or computer is normal, and no one's permission is needed. Work and school devices are different: their DNS and proxy settings are usually there on purpose, so talk to the IT team before you change anything on one.

Make leak testing a habit

DNS settings can change quietly after a system update, a switch to a new network or a reinstall. A setup that passed last month can leak today. Run a quick check whenever you start something sensitive or join a new network, the same way you'd check your exit address. It takes less than a minute, and it's the difference between hoping you're private and knowing it.

Beginner questions

Does a DNS leak show my IP address?

It shows which websites you look up to whoever runs the resolver, usually your internet provider. The leak test also shows where those resolvers are, which can point back to your real location even when your IP address is hidden.

Is encrypted DNS the same as a VPN?

No. Encrypted DNS only protects the name look-ups. A VPN or proxy changes the address websites see and carries the traffic itself. They work well together, but neither replaces the other.

Does every proxy or VPN leak?

No. Plenty are set up correctly from the start. Leaks depend on the app, the device and the settings, which is exactly why testing beats guessing.

A DNS leak gives your privacy away at the very first step of every connection. Test before you trust, let your proxy look up names, pin down your DNS settings and check again after each change. Do that, and your look-ups stay as private as the traffic you set out to protect.