How to check whether DNS is leaking through a VPN
A DNS leak is when the VPN tunnel is working, but site name resolution requests go around the tunnel, directly to your ISP’s DNS server. As a result, the traffic itself is encrypted, but the operator can still see which domains you visit. For privacy, this reduces most of the point of a VPN to zero.
You can check for a leak in a minute: a test on a third-party service (for example, dnsleaktest.com) compares which DNS servers actually respond to your requests. If the list contains the IP address of your ISP or regional operator, there is a leak. If it contains only the VPN provider’s IP addresses or its DNS servers, the tunnel is closed correctly.
Below: exactly how a leak appears, how to check it step by step (the “before VPN” and “after VPN” scenario), and which settings in Hiddify, Amnezia, and other modern clients close the issue in one click.
In brief
- DNS leak = your ISP sees where you go even when the VPN is enabled.
- Check: open dnsleaktest.com, click Extended test, and look at the list of DNS servers.
- Compare two runs: without VPN and with VPN. The DNS IP addresses should change completely.
- If your operator’s IP address remains after enabling the VPN, there is a leak.
- Hiddify and Amnezia have built-in DNS leak protection, enabled in the settings.
- A WebRTC leak is a separate scenario, checked on browserleaks.com or dnsleaktest.com.
Where a DNS leak comes from: main scenarios
The nature of the leak is that a DNS request and ordinary TCP traffic can use different paths in the system. A VPN intercepts routes for data packets, but the DNS resolver may be configured outside the tunnel — and then part of the privacy protection falls away.
System DNS has higher priority than the VPN
This is especially common on Windows and Android: the VPN has brought up the interface, but the operating system continues to contact the DNS server provided by the operator’s DHCP. In some implementations this is intended for stability, but in practice it is the classic leak.
The VPN client does not push its own DNS
Some “lightweight” clients or third-party protocol builds do not replace the DNS resolver with their own when connecting. The tunnel exists, the route to 0.0.0.0/0 exists inside it, but DNS is still the old one. As a result, names are resolved outside the VPN.
IPv6 without a tunnel
If the operator has IPv6 enabled and the VPN intercepts only IPv4, DNS requests over the IPv6 path can quietly go to the ISP. The solution is either to disable IPv6 on the device or to use a VPN with full dual-stack support.
A browser with its own DoH
Chrome, Firefox, and Edge support DNS-over-HTTPS on top of system DNS. Sometimes this fixes a leak (requests go to a public DoH service through the VPN), and sometimes the opposite happens: they go around the tunnel. The behavior depends on the settings and the specific build.
Symptoms of a DNS leak
| What you see in the test | What it means | What to do |
|---|---|---|
| A DNS server from your operator’s IP range | Direct leak — DNS is bypassing the tunnel | Enable “Block DNS leaks” in the client |
| Several IP addresses, some from your country | Partial leak, often due to IPv6 | Disable IPv6 on the interface |
| Only the VPN provider’s IP addresses or 1.1.1.1 / 8.8.8.8 | No leak | Nothing, everything is fine |
| Your city’s geolocation is visible | A local operator is answering DNS | Switch to DNS inside the tunnel |
| A local IP appears in WebRTC on browserleaks | WebRTC leak, not DNS | Disable WebRTC in the browser or client |
| Before VPN and after — the same list | The VPN does not replace DNS at all | Change the client or enable the required option |
How to check right now
A two-step scenario. First: disable the VPN, open dnsleaktest.com, click Extended test, and note which DNS servers appear in the results — this is “without VPN.” Second: connect the VPN, reload the page, and run Extended test again. If the list has changed completely and contains only IP addresses that do not belong to your operator, the tunnel is sealed.
If you use Hiddify or Amnezia, DNS leak protection settings are already built into the client; they need to be explicitly enabled. Hiddify configuration documentation, including DNS handling, is available in Hiddify Manager.
It is also useful to check through Freedom Checker which sites open for you with a VPN and which open without one, across different operators and regions.
Failure or blocking?
A DNS leak is not a failure and not blocking; it is a configuration property. A failure looks different: sites do not open at all, DNS errors appear, or there are timeouts. A leak does not interfere with operation — it “simply” makes privacy useless, and until you run a test, you can live with it for years.
Blocking is the opposite story: DNS responds, but returns a deliberately incorrect address (NXDOMAIN or an operator stub address). If the VPN intercepts DNS and sends it through the tunnel, this kind of block is easy to bypass, because the DNS request goes to a server that is not subject to Russian filtering rules.
What to pay attention to
- Run the test in two modes in a row: without VPN and with VPN. A comparison is clearer than a single run.
- Use Extended (more than 6 requests), not Standard — it catches partial leaks more accurately.
- If you have IPv6 enabled, check for a leak separately over IPv6.
- In the browser, check WebRTC leak separately — it exposes the real IP even with perfect DNS.
- In Hiddify and Amnezia, enable “Block DNS leaks” or the equivalent option.
- At the system level, you can manually set DNS in the VPN interface settings (1.1.1.1, 9.9.9.9).
- Free VPNs often do not close leaks at all — they simply do not have this setting.
Conclusion
A DNS leak is the quietest way to lose privacy while a VPN is enabled. The check takes a minute and requires nothing except a browser. If the very first test shows your operator’s DNS servers in the list, that is a signal to urgently fix the client settings or change the client itself.
Do not rely on “I have a green VPN icon” — the icon only means that a tunnel exists, not that it is sealed.