VPN DNS Explained: How DNS Affects Your Privacy

When you type example.com into your browser, your device first asks a DNS resolver to translate that name into an IP address. Without a VPN, that resolver is operated by your ISP (Comcast, Verizon, AT&T, etc.).

This means your ISP sees a record of every domain you visit — even if the actual page content is encrypted via HTTPS. In the United States, ISPs are legally permitted to log and sell this browsing data to advertisers since Congress repealed the FCC's broadband privacy rules in 2017.

DNS queries are also typically unencrypted (sent over plain UDP port 53), which means anyone monitoring the network — including a hotel Wi-Fi operator or a hostile coffee-shop network — can read them too.

When you connect to a properly configured VPN, your DNS queries are routed through the encrypted tunnel to a DNS resolver operated by the VPN provider — not your ISP.

This hides your browsing history from your ISP and from anyone monitoring the network between your device and the VPN server. The VPN provider can technically see your DNS queries, which is why an published privacy policy matters (see our privacy guide).

Most premium VPNs operate their own DNS infrastructure rather than forwarding to third parties like Google or Cloudflare. ExpressVPN, NordVPN, ProtonVPN, and Mullvad all run private DNS resolvers.

A DNS leak happens when your device sends DNS queries to your ISP's resolver instead of (or in addition to) the VPN's resolver — even though the VPN tunnel is connected. The result: your encrypted traffic appears to go through the VPN, but your browsing history is still visible to your ISP.

Common causes:

• Operating system DNS shortcuts — Windows in particular has historically sent DNS queries to all configured network interfaces simultaneously, including the underlying ISP connection.
• IPv6 DNS leaks — If your VPN only routes IPv4 traffic but your network has IPv6 enabled, IPv6 DNS queries can leak around the tunnel.
• Misconfigured VPN apps — Older or budget VPN apps sometimes don't override the system DNS resolver.
• Browser-level DNS settings — If a browser is configured to use its own DNS-over-HTTPS resolver (e.g., Firefox's default), DNS queries can leak around the VPN.

Test for leaks with our free DNS Leak Test — a clean result shows only your VPN provider's resolver.

Several modern protocols encrypt DNS queries themselves, separately from any VPN tunnel:

• DNS-over-HTTPS (DoH) — Wraps DNS in an HTTPS connection. Used by Cloudflare 1.1.1.1, Google 8.8.8.8, and others. Indistinguishable from regular HTTPS traffic.
• DNS-over-TLS (DoT) — Wraps DNS in a TLS connection over port 853. Slightly faster than DoH but easier for networks to block.
• DNSCrypt — Earlier encrypted-DNS protocol, still used by some open-source resolvers.

These protocols protect DNS even without a VPN. With a VPN, they provide an extra layer if the VPN's own DNS handling has a misconfiguration. NordVPN, Mullvad, and ProtonVPN all support DoH or DoT for their resolvers.

Run these three checks, in this order:

1. Check your IP: Visit What Is My IP. Confirm the IP and ISP shown match your VPN provider, not your home ISP.
2. Check for DNS leaks: Visit DNS Leak Test. Every resolver shown should belong to your VPN provider — not your ISP.
3. Check for WebRTC leaks: Visit WebRTC Leak Test. Browsers can leak your real IP via WebRTC even when DNS is properly tunneled.

If any test shows your real ISP, switch protocols (try WireGuard if you're on OpenVPN), enable IPv6 leak protection in your VPN app, and disable browser-level DoH (or set it to use your VPN's resolver).