How to Fix DNS Leak with Proton VPN
A DNS leak can expose the websites you visit even when your VPN tunnel is active.
This guide explains how to fix DNS leak with Proton VPN and verify that your DNS requests stay private.
What a DNS leak is and why it matters
When you type a domain name such as example.com, your device asks a Domain Name System, or DNS, resolver to translate it into an IP address.
If those requests leave the encrypted VPN tunnel and reach your internet service provider or another third-party resolver, your browsing activity can be exposed.
Proton VPN is designed to route traffic through its own DNS infrastructure while the VPN connection is active, but leaks can still happen because of local settings, operating system behavior, browser configuration, or network features such as IPv6 and split tunneling.
How to tell whether Proton VPN is leaking DNS
The first step is to confirm the problem before changing settings.
A proper test helps you identify whether the issue is caused by the VPN app, your device, or your network.
- Connect to Proton VPN.
- Open a DNS leak test site such as dnsleaktest.com or browserleaks.com.
- Run both a standard and extended test.
- Check the listed resolvers and their locations.
If you see your ISP, your home router, or a public resolver that does not match Proton VPN’s expected behavior, you likely have a DNS leak.
A few resolver entries can be normal if they belong to Proton’s network or a trusted privacy-preserving path, but local ISP servers are a red flag.
How to fix DNS leak with Proton VPN on desktop
Most DNS leaks can be corrected by reviewing the Proton VPN app and your system network settings.
Start with the least invasive fixes and test again after each change.
1. Update Proton VPN
Older app versions may not include the latest network protections or bug fixes.
Install the newest Proton VPN release for Windows, macOS, or Linux, then reconnect and rerun a DNS leak test.
2. Use the built-in kill switch
The kill switch helps prevent traffic from leaving the device if the VPN disconnects unexpectedly.
In Proton VPN, enable the kill switch feature in the app settings so DNS requests are not briefly exposed during reconnects.
3. Prefer the official Proton VPN DNS handling
Do not manually set custom DNS servers unless you have a specific reason.
Proton VPN is built to manage DNS requests through its own protected path while connected.
Custom system DNS entries can override that behavior and create leaks.
4. Disable IPv6 if your setup leaks through it
Some VPN and network configurations still handle IPv4 correctly while IPv6 traffic bypasses the tunnel.
If your leak test shows IPv6 resolvers outside Proton VPN, temporarily disable IPv6 on the adapter or at the system level and test again.
5. Check split tunneling and local network exceptions
Split tunneling lets selected apps or destinations bypass the VPN.
That feature is useful for certain workflows, but it can also expose DNS traffic if the browser or system resolver is excluded.
Review any split-tunneling rules and remove anything unnecessary.
6. Flush the DNS cache
Your operating system may keep old DNS entries after you connect to Proton VPN.
Flushing the cache clears stale records and forces fresh lookups through the active network path.
- Windows: run ipconfig /flushdns in Command Prompt.
- macOS: use the appropriate sudo killall -HUP mDNSResponder command for your version.
- Linux: restart the network service or the local resolver, depending on your distribution.
How to fix DNS leak with Proton VPN on mobile
Mobile platforms add their own network controls, background app restrictions, and private DNS settings.
If you are using Proton VPN on Android or iPhone, the fix often involves checking the operating system rather than the VPN app alone.
Android
- Turn on the Proton VPN always-on VPN setting if available.
- Disable Android Private DNS temporarily to see whether it conflicts with the VPN path.
- Reconnect to Proton VPN and rerun a leak test using the mobile browser.
- If you use battery optimization, exempt Proton VPN so the app is not suspended in the background.
iPhone and iPad
- Ensure the Proton VPN profile is active in Settings.
- Reconnect after switching networks, especially between Wi-Fi and cellular.
- Remove any third-party DNS or content-filtering profiles that may override VPN behavior.
- Test again after a full reconnect, not just after opening the app.
Browser settings that can cause DNS leaks
Even with a VPN active, browser features can reveal network information or route DNS queries in unexpected ways.
This is especially relevant in Chromium-based browsers and Firefox when privacy settings or extensions are customized.
- Disable secure DNS or DNS-over-HTTPS tests if they conflict with Proton VPN expectations.
- Review privacy extensions that manage proxies, DNS, or WebRTC.
- Check WebRTC leak settings in the browser.
- Clear site data if a browser profile retains old network preferences.
WebRTC does not always cause a DNS leak by itself, but it can expose local and public IP details that make network identification easier.
If you are troubleshooting privacy exposure, check DNS and WebRTC together.
Router and network-level fixes
Sometimes the leak begins before traffic reaches the device.
This is common on shared networks, office Wi-Fi, or home routers with custom DNS settings.
Review router DNS settings
If your router is hardcoded to use an ISP resolver, connected devices may inherit that setting unless the VPN overrides it completely.
Change the router DNS configuration only if you understand the impact on other devices, and then test again with Proton VPN connected.
Watch for captive portals and managed networks
Hotel, school, and corporate networks may intercept DNS, block VPN traffic, or force their own resolvers.
In these environments, Proton VPN may work intermittently, which can look like a DNS leak.
Reconnect after authenticating to the network and confirm that the tunnel is stable.
Disable conflicting security software
Some endpoint security tools, parental controls, and ad-blocking suites insert local DNS filtering.
These tools can override the VPN path or generate false positives in leak tests.
Temporarily disable them to isolate the cause.
Proton VPN features that help prevent leaks
Proton VPN includes features that reduce the risk of DNS exposure when configured correctly.
Understanding these options helps you keep the fix in place.
- Kill switch: blocks traffic if the VPN drops.
- Always-on VPN: reconnects automatically on supported devices.
- Secure Core: routes traffic through hardened multi-hop servers for added privacy.
- Split tunneling controls: allow selective bypass only when needed.
For most users, the safest setup is simple: keep the app updated, use the default Proton DNS handling, enable the kill switch, and avoid unnecessary custom DNS or tunneling rules.
When the leak still appears after troubleshooting
If you still see a DNS leak after checking the app, system settings, browser settings, and router configuration, the issue may be tied to a specific operating system build or a network driver conflict.
Reinstalling Proton VPN, rebooting the device, or switching to a different server can often resolve persistent routing problems.
If the leak persists only on one network, the router or upstream network policy is the likely source.
If it happens on every network, focus on the local device configuration and the VPN app version.
In either case, retest after each change so you know which fix actually worked.
DNS leak prevention checklist for Proton VPN
- Update Proton VPN to the latest version.
- Enable the kill switch.
- Use Proton VPN’s default DNS handling.
- Disable IPv6 if tests show exposure.
- Review split tunneling rules.
- Flush the system DNS cache.
- Check browser DNS and WebRTC settings.
- Inspect router and managed network DNS policies.
- Retest on multiple DNS leak test sites.