Your IP: checking…What websites can see
Get DarkMatter

Leak protection

DNS leak protection

Before a site loads, your device asks a DNS resolver where to find it. DNS leak protection is designed to send those lookups through the encrypted tunnel, not out to the resolver your local network hands you.

  • Designed to keep DNS lookups inside the VPN tunnel
  • Helps stop your Wi-Fi operator or provider seeing the names you look up
  • Included on every plan, with IPv6 leak protection
Get DarkMatterHow it works
  • 30-day money-back guarantee on your first purchase (14 days on monthly plans)
  • Up to 5 devices at once
  • Windows, macOS, iOS, Android and Fire TV

What it is

What is a DNS leak?

In short

DNS is the internet’s address book: it turns a name like example.com into the numeric address your device connects to. A DNS leak happens when those lookups travel outside the VPN tunnel. DNS leak protection is designed to route them through the tunnel, so the network you’re on sees only encrypted traffic.

How it works

How DNS leak protection works

Your device learns which DNS resolver to use from the network it joins. That’s where leaks come from: even with a VPN connected, a device can keep asking the resolver the local network gave it.

Where DNS lookups go, with and without leak protection (general mechanics)
  • Encrypted VPN tunnel
  • Normal connection
  • DNS lookup outside the tunnel
Lookup outside the tunnelLookups visibleSent in the openYour deviceAsks where a site livesLocal networkCan see the names you lookupTheir DNS resolverAnswers, and may keep arecordWith DNS leak protectionLookups kept in the tunnelThrough the tunnelYour deviceAsks where a site livesVPN serverLocal network seesencrypted trafficDNS resolverReached through the VPNLookup outside the tunnelLookups visibleYour deviceAsks where a site livesSent in the openLocal networkCan see the names you look upTheir DNS resolverAnswers, and may keep a recordWith DNS leak protectionLookups kept in the tunnelYour deviceAsks where a site livesThrough the tunnelVPN serverLocal network sees encryptedtrafficDNS resolverReached through the VPN
Read this diagram as text

Two rows. Row one, a lookup outside the tunnel: your device asks where a site lives and the request is sent in the open across the local network, which can see the names you look up, to that network’s DNS resolver, which answers and may keep a record. Row two, with DNS leak protection: the lookup goes through the encrypted tunnel to the VPN server, so the local network sees only encrypted traffic, and it is answered by a DNS resolver reached through the VPN. This shows how DNS leaks work in general.

  1. You open a site

    Before anything loads, your device needs the site’s numeric address, so it sends a DNS lookup.

  2. The lookup goes into the tunnel

    While you’re connected, DNS leak protection is designed to send that lookup through the encrypted tunnel instead of to the local network’s resolver.

  3. The answer comes back the same way

    A resolver reached through the VPN answers, and your device connects to the site through the tunnel.

Without this protection, a lookup can be sent in the open to a resolver run by the café, the hotel or your internet provider. The page itself might travel through the VPN, while the list of names you looked up doesn’t.

That list is revealing on its own. Even without the contents of a page, the names of the sites you visit say a lot about what you’re doing and when.

Why it matters

Where it makes a difference

DNS leaks are easy to miss because nothing looks wrong. Pages load, and the VPN says it’s connected.

  • Public Wi-Fi

    Whoever runs a shared network can see unprotected lookups crossing it. Keeping them in the tunnel keeps that list away from them.

    Using a VPN on public Wi-Fi

  • Travelling

    Hotel and airport networks hand out their own DNS resolvers. DNS leak protection is designed so your lookups don’t go to them while you’re connected.

    Using a VPN while travelling

  • Filtered networks

    Some networks filter websites by interfering with DNS. A VPN can help on some of them, but we can’t promise any particular site will load; that depends on the network and the site.

    Blocked websites and VPNs

Side by side

How it compares

Who can see the site names you look up
No VPNVPN with a DNS leakVPN with DNS leak protection
Wi-Fi or network operatorCan see themCan see themSees encrypted traffic
Your network’s DNS resolverReceives themReceives themDesigned not to receive them
The pages themselvesNot encrypted by a VPNEncrypted in the tunnelEncrypted in the tunnel

General mechanics of DNS leaks, not a test of a particular device.

The honest bit: what it can’t do

  • DNS leak protection covers lookups while the VPN is connected. If the tunnel drops, it’s the kill switch in our Windows app that’s designed to hold traffic back; our other apps don’t have one.
  • Some browsers have their own secure DNS setting, which works separately from the VPN. How the two interact depends on your browser and device.
  • A resolver still has to answer your lookups. The protection keeps them away from the network in between; it doesn’t make them disappear.
  • We don’t offer a DNS leak test yet. The WebRTC test below checks a different kind of leak.

Check it yourself

See the difference for yourself

We don’t have a DNS leak test yet. These tools check related things: the address sites see, and a separate browser leak.

DNS Leak Protection

Common questions

What is a DNS leak?

It’s when the lookups your device makes to find websites travel outside the VPN tunnel, usually to a resolver run by your local network or internet provider, even though the VPN is connected.

Why does a DNS leak matter if my traffic is encrypted?

Because the lookups can reveal the names of the sites you visit, even when the pages themselves travel through the tunnel.

Does DNS leak protection hide my visits from the websites themselves?

No. It keeps your lookups away from the network in between. The sites you visit still see the visit, from the VPN server’s IP address rather than yours.

Can I test for DNS leaks on your site?

Not yet. Our WebRTC leak test checks a different kind of leak, and What is my IP shows the address websites see for your connection.

What about my browser’s secure DNS setting?

Browser secure DNS settings are separate from the VPN, and how the two interact depends on your browser and device.

Is DNS leak protection on every plan?

Yes. Every plan includes every feature, including DNS and IPv6 leak protection. See plans.

Included on every plan

Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.

Get DarkMatter
  • 30-day money-back guarantee on your first purchase (14 days on monthly plans)
  • Up to 5 devices at once
  • Windows, macOS, iOS, Android and Fire TV

Related features

Last reviewed