TorSentinel Team •
Deep Dive
DNS Leak
VPN
Privacy
DNS
DNS Leaks Explained:
How They Happen and How to Stop Them for Good
DNS leaks are among the most common — and most misunderstood — network privacy issues. Even when your traffic routes through a VPN or proxy, a resolver leak can expose every domain you visit to your ISP or local network. This guide explains how they happen, how to find them, and how to prevent them permanently.
TorSentinel Team
·
Updated 2025
·
7 min read
·
Intermediate
? What is a DNS leak?
When you visit a website, your system first queries a DNS resolver to translate the domain name into an IP address. If those queries do not follow the same path as the rest of your protected traffic, the resolver — and anyone observing it — can see what domains you visit, even if the content itself is fully encrypted.
⚠
A DNS leak means your ISP can build a complete log of your browsing activity even while your VPN or proxy is active and your IP is hidden.
⚠ Why DNS leaks happen
✕
Mixed adapter states
The system keeps the default network route active while the VPN adapter is also connected — DNS takes the shorter, unprotected path.
✕
Incorrect resolver binding
The DNS service is not pinned to the VPN adapter or proxy interface, so it resolves via whichever adapter has the lowest metric.
✕
Manual DNS entries in OS settings
Hardcoded DNS entries override the resolver pushed by your VPN tunnel, sending queries to a different server outside the protected path.
✕
DoH or DoT mismatch
A browser using its own encrypted resolver (Chrome, Firefox, Edge all do this by default) that doesn't follow system DNS policy — queries bypass the VPN entirely.
🔍 Common leak sources
System resolver service
Continues using the default interface after the tunnel is established — most common on Windows with stub resolver.
Third-party DoH / DoT apps
Override the system resolver chain entirely, sending queries to their own servers outside the VPN path.
Virtualization and containers
VMs and Docker containers use separate namespaces with their own DNS path that may not inherit the host's VPN routing.
IPv6 fallback
The VPN tunnels IPv4 only, letting IPv6 DNS queries resolve directly through your ISP's resolver. Very common and easy to miss.
🔬 How to test for leaks
1
Connect your VPN or proxy as usual
2
Run a leak test service or use terminal commands below to query known test domains
3
Compare resolver IPs shown — they should belong to your trusted resolver, not your ISP
4
Disable the secure path and retest — confirm the resolver changes to confirm what you're measuring
Practical testing commands
# Query TorSentinel test domain
dig test.torsentinel.net
nslookup test.torsentinel.net
# Check active DNS entries (Windows)
ipconfig /all | findstr DNS
# Check routing table (all platforms)
netstat -rn
# Check active resolver (Linux)
resolvectl status
🛡 How to prevent DNS leaks
1
Pin the resolver
Use a DNS server reachable only through your VPN or proxy adapter. If the tunnel is down, DNS fails — which is exactly what you want.
2
Match DNS with the traffic path
Ensure DNS requests follow the same interface as your app data. Adapter binding at the OS level makes this reliable.
3
Disable external DoH unless managed
In Firefox:
about:config → network.trr.mode = 5. In Chrome: disable Secure DNS in privacy settings. Keep resolver policies centralized.
4
Unify IPv4 and IPv6 behavior
Configure both through the tunnel or disable IPv6 entirely. Never leave them on different paths — IPv6 leaks are the most silently common DNS leak type.
5
Validate after every restart
Adapter order and routing tables change after reboot or suspend/resume. A correct setup today can drift silently without monitoring.
⚙ Advanced mitigation
→
Firewall adapter binding for DNS: enforce via nftables, iptables, or Windows Firewall rules that only allow DNS traffic out via the trusted interface
→
Internal resolver inside the tunnel: if your VPN or proxy provider offers a resolver inside the encrypted path, use it — queries never leave the tunnel at all
→
DNS query log monitoring: watch for queries routed outside the intended adapter — TorSentinel Monitor detects resolver changes in real time
→
Post-connect automation: automate verification with scripts or monitoring agents that run each time the tunnel connects or reconnects
Summary checklist
✓
DNS leaks reveal visited domains even when traffic is encrypted — treat them as seriously as an IP leak.
✓
Pin resolvers to the secure adapter and route lookups consistently with app traffic.
✓
Monitor for IPv6 fallback and browser DoH overrides — both bypass system DNS policy silently.
✓
Retest after every OS update, reboot, and network change — configuration drift is the most common cause of unexpected leaks.
Find out if you have a leak right now
Free torrent IP check — no signup
Most DNS tests check your browser. TorSentinel checks the IP your torrent client announces — which is where DNS leaks hit hardest.