Kaveo
A DNS leak is a situation where the VPN works but name lookups bypass the tunnel. The provider then sees a list of domains although you expected otherwise. Here is the mechanics and how to read a check result.
How it works
Before opening a site, the device asks a DNS server: what is the IP of this domain? Only then does the connection start.
With a VPN connected, both steps usually go through the tunnel. With a wrong setup the first step, the name lookup, may go to your internet provider's server. The connection itself is encrypted, but the provider sees the list of sites.
Three questions instead of one
A DNS query has three independent characteristics, and a conclusion cannot be drawn from one of them.
- Who owns the resolver. The organisation whose server answers the query: a provider, a VPN service, a public DNS service. A third-party DNS alone neither confirms a leak nor proves there is none: the resolver may have been chosen by the settings of the app or browser.
- Which transport the query uses. Plain DNS, DNS over HTTPS (DoH) or over TLS are different ways of delivering the same question.
- Which route the query takes. Through the tunnel or directly. The route answers the leak question; the name of an organisation in a list does not.
Where discrepancies come from
- Manual setup. A configuration without a DNS parameter leaves the system values.
- Several DNS servers at once. The system may query several servers and take the fastest answer, as some versions of Windows do.
- IPv6. The tunnel is up for IPv4 while IPv6 queries go directly. Distinguish DNS queries over IPv6 from other traffic carried over IPv6: they are different things, and one does not imply the other.
- Browser DoH. The browser may use its own DNS server with its own settings. This is a separate mechanism: its presence is not the same as bypassing the VPN, and the route of such a query depends on how the app and the browser are configured together.
How to check in a minute
- Connect to the VPN.
- Open any DNS check service: search for "dns leak test".
- Run the extended test.
- Look at the list of servers in the results and at who they belong to.
If the list has your provider's servers, that is a reason to check the route and settings, not a final verdict. If there are only the VPN provider's or neutral servers, no leak is visible in this test. A third-party public DNS in the list may be either a choice made by the settings or a sign of a problem: compare the result with the settings of the app and the browser.
What to do if the result raises questions
First: check the app settings and the developer's instructions. Protection from DNS leaks depends on the app and platform and cannot be promised universally.
Second: review how IPv6 behaves on your system and network. Turning IPv6 off is not a universal fix: it can affect other programs and is not always needed.
Third: check whether the browser uses its own secure DNS (DoH). Whether to change it is up to the test results; turning DoH off is not universal advice.
Fourth: with a manual configuration, set DNS servers explicitly.
A quick way to compare the address is the IP check page; the general order of checks is in the article how to check that a VPN works.
Compare the result with the settings of the app and the browser. The name of a DNS service, a local address or a matching country does not by itself give a full verdict on how the VPN works.
How critical is it
The page content stays protected by encryption in a leak. What leaks is the list of domains, that is, which sites you opened and when. For many tasks that is enough to take the problem seriously, but the decision depends on your threat model.
Related reading
Plans and 8 hours free without a card: see Kaveo plans.