What a DNS leak is and why it matters on Windows
If your VPN is active but your DNS requests still go through your ISP or another resolver, you may have a DNS leak.
On Windows, this can expose the websites you visit even when your IP address appears protected, which is why knowing how to fix DNS leak with VPN on Windows is essential for privacy, security, and reliable access to geo-restricted services.
Windows networking uses multiple layers, including the built-in DNS Client service, adapter settings, IPv4 and IPv6 stacks, and sometimes vendor software that can override your VPN’s intended DNS path.
That combination makes leaks more common than many users expect.
How Windows handles DNS when a VPN is connected
When a VPN connects, it should route both traffic and DNS queries through the encrypted tunnel.
In practice, Windows may continue using cached DNS settings, multiple network adapters, or fallback resolvers if the VPN client is not configured to push DNS correctly.
- Physical adapter DNS settings: Ethernet or Wi-Fi adapters may still point to ISP DNS servers.
- VPN adapter DNS settings: The VPN tunnel adapter should receive the correct DNS servers from the provider.
- IPv6 traffic: If the VPN only protects IPv4, IPv6 DNS queries can leak outside the tunnel.
- Windows DNS cache: Cached lookups can keep old resolver behavior active until cleared.
- Split tunneling: Some apps or traffic may bypass the VPN by design and use local DNS.
Check whether you actually have a DNS leak
Before changing settings, confirm the problem with a DNS leak test while the VPN is connected.
Use a trusted leak testing site and compare the reported DNS servers with your VPN provider’s DNS endpoints or the DNS servers your provider documents.
What to look for in the results
- DNS servers belonging to your ISP, mobile carrier, or home router
- DNS servers in a different country than your VPN exit location
- Multiple DNS servers from mixed providers, which may indicate fallback behavior
- IPv6 DNS entries even though you expected only IPv4 protection
If the test shows your ISP or local network, you need to adjust Windows, the VPN app, or both.
Enable the VPN’s built-in DNS protection
Most reputable VPNs include a DNS leak protection feature, but it is not always enabled by default.
Open the VPN client’s settings and look for terms such as DNS leak protection, use VPN DNS, private DNS, or network lock.
- Turn on the VPN’s DNS leak protection option.
- Enable the kill switch if available, since it prevents traffic from falling back to the local network.
- Choose the VPN’s DNS servers instead of custom or automatic ISP DNS if the app allows it.
- Reconnect after changing the setting so the new DNS configuration is pushed to Windows.
If your VPN vendor supports WireGuard, OpenVPN, or IKEv2, check whether the protocol choice affects DNS handling.
Some clients manage DNS more reliably under one protocol than another.
Set Windows to prefer the VPN adapter for DNS
Windows may prioritize one network interface over another based on interface metrics.
If the VPN adapter has a lower priority than the physical adapter, DNS requests can escape through the wrong path.
Adjust adapter priority in Windows
- Open Control Panel and go to Network and Internet.
- Select Network Connections.
- Right-click the VPN adapter and open Properties.
- Open Internet Protocol Version 4 and then Advanced.
- Clear Automatic metric and assign a lower metric value to the VPN adapter than to Wi-Fi or Ethernet.
This helps Windows send DNS traffic through the VPN interface first.
If you are using a modern VPN client, the app may also apply its own routing rules, so test after each change.
Flush DNS cache and reset network state
A cached resolver entry can keep Windows using outdated DNS information even after the VPN is fixed.
Clearing the cache is a fast way to eliminate stale state and verify that the current tunnel settings are taking effect.
Run these commands in Command Prompt as administrator
ipconfig /flushdnsipconfig /releaseipconfig /renewnetsh winsock reset
After running these commands, restart the computer and reconnect the VPN.
This is especially useful if you recently changed DNS settings, switched VPN servers, or updated the VPN client.
Disable IPv6 if your VPN does not support it
IPv6 is a common cause of DNS leaks on Windows because some VPNs tunnel only IPv4 traffic.
If your provider does not explicitly support IPv6 protection, disabling it on the active network adapter can prevent DNS requests from bypassing the tunnel.
When to disable IPv6
- Your VPN provider says IPv6 is unsupported.
- Leak tests show IPv6 DNS servers outside the tunnel.
- You see inconsistent privacy results between browsers and system-wide tests.
To disable it, open the properties for your active network adapter and uncheck Internet Protocol Version 6 (TCP/IPv6).
Reconnect the VPN afterward and retest.
Change DNS servers manually if needed
In some cases, manually setting DNS servers on the VPN adapter or the physical adapter can improve consistency.
This should be done carefully, because the wrong configuration can worsen leaks or break name resolution.
Use only DNS servers recommended by your VPN provider or privacy-focused public resolvers such as Cloudflare DNS or Quad9, depending on your policy and trust requirements.
If the VPN client supports pushing DNS automatically, that is usually safer than manual configuration.
Best practices for manual DNS setup
- Apply the setting to the adapter currently used by the VPN client.
- Avoid mixing ISP DNS with VPN DNS.
- Test both IPv4 and IPv6 behavior if IPv6 is enabled.
- Document the original settings so you can roll back changes if needed.
Check browser and app-level DNS features
Some browsers and apps use their own DNS logic, which can interfere with Windows and VPN settings.
Chrome, Edge, and Firefox may support secure DNS features such as DNS over HTTPS, which can help privacy but may also create confusion during troubleshooting.
What to review
- Browser secure DNS: Verify whether the browser is using custom resolvers.
- Split tunneling: Make sure the affected app is not excluded from the VPN.
- Security software: Some antivirus and firewall products inspect or redirect DNS traffic.
- Parenting or enterprise controls: Managed devices can enforce DNS policies that override your preferences.
If you are troubleshooting a specific app, test it separately from the browser to isolate whether the leak is system-wide or application-specific.
Update the VPN client and Windows network components
Outdated VPN software is a common reason DNS leak protection fails on Windows.
VPN vendors often patch adapter handling, protocol support, and DNS routing issues in client updates.
- Install the latest VPN app version from the provider.
- Run Windows Update to get network stack and adapter fixes.
- Update your network adapter driver from the PC or motherboard vendor.
- Reboot after updates to ensure the new networking components load correctly.
If the leak started after a recent update, check the VPN provider’s support notes for known issues with your Windows version, protocol, or adapter driver.
Verify the fix with repeat testing
After each change, reconnect the VPN and run another DNS leak test.
A successful fix should show DNS servers that belong to the VPN provider or a resolver you intentionally configured, with no references to your ISP or local network.
For the most reliable check, test on both Wi-Fi and Ethernet, and repeat with a few different VPN servers.
This helps confirm that the solution is stable rather than tied to one location or one connection type.
Common reasons DNS leaks persist on Windows
If the leak continues, one of these issues is usually responsible:
- The VPN app does not fully control DNS on Windows.
- IPv6 remains active while only IPv4 is tunneled.
- Adapter priority sends queries through the wrong interface.
- Windows cache is holding stale resolver data.
- Split tunneling is intentionally bypassing the VPN.
- Security software or enterprise policy overrides DNS settings.
Working through these layers in order is the fastest way to fix DNS leak with VPN on Windows without making unnecessary changes.