DNS & ISP

What Is a DNS Leak and How to Test for One

A VPN hides your traffic, but if your DNS lookups go around the tunnel, your ISP still sees every site you visit. That is a DNS leak, and it is more common than people expect.

Last updated October 18, 2026 · By Harbor Privacy

What a DNS Leak Is

Every site visit starts with a DNS lookup. With a VPN on, those lookups should travel inside the tunnel to the VPN's resolver. In a leak, the device sends them to your ISP's DNS server or a public one outside the tunnel, so the lookups are visible even though the rest of your traffic is not.

Why Leaks Happen

The system uses its own DNS. Windows, for example, can send lookups to every network adapter at once.
A DoH or private DNS setting overrides the VPN. The browser or phone talks to its own resolver directly.
IPv6. A VPN that only handles IPv4 can leave IPv6 traffic outside the tunnel.
The tunnel drops. Traffic falls back to the normal connection without warning.

How to Test

Connect the VPNMake sure it shows as active.

Run a DNS leak testUse a test site that lists which DNS servers answered your lookups.

Read the resultYou should see the VPN provider's resolver, or none of your ISP's. Your ISP's name in the list means a leak.

Repeat on each networkTest on Wi-Fi and on cellular.

How to Fix a Leak

Turn off custom DNS or DoHRemove DNS overrides in the browser, the OS, and any security app.

Use the VPN's DNSLet the tunnel supply the resolver.

Enable leak protectionChoose a VPN that blocks DNS traffic outside the tunnel at the firewall.

Handle IPv6Use a VPN that supports IPv6, or disable IPv6 on the device.

How Harbor VPN Handles It

Every Harbor VPN tunnel uses Harbor's own threat-blocking resolver, and DNS bypass attempts are blocked at the server firewall instead of relying on the client alone. If you use a custom DNS or DoH setting on the same device, it can still override the tunnel, so remove it. See Harbor VPN.

Common Questions

Is a DNS leak dangerous?

It exposes the sites you visit to your ISP, which defeats one of the main reasons to use a VPN.

Does a DoH setting cause a leak?

It can. The browser or phone may send lookups straight to its DoH resolver instead of through the tunnel.

What is an IPv6 leak?

Traffic over IPv6 that bypasses a VPN configured only for IPv4.

How often should I test?

After you set up a VPN, change DNS settings, or switch networks.

Does a kill switch stop leaks?

It helps when the tunnel drops, since it blocks traffic until the VPN returns. It does not fix a DNS override.

TRY HARBOR VPN

Threat-blocking DNS on every tunnel with bypass protection at the firewall. See Harbor VPN.