We Ran 1,000 DNS Leak Tests — Here's Which VPNs Actually Prevent Them
DNS leaks are the silent killer of VPN privacy. Your VPN tunnel can be perfectly intact while every website you visit is still being logged by your ISP — because your DNS queries are slipping outside the tunnel entirely. We ran 1,000 DNS leak tests across 12 VPN services using our DNS Leak Test tool to find out which ones actually plug this hole.
The headline finding: 4 out of 12 VPNs we tested had DNS leaks on at least one test. Two leaked on every single test.
What a DNS Leak Actually Means
When you type a URL, your device sends a DNS query to translate it into an IP address. With a VPN, that query should go through the VPN's encrypted tunnel to the VPN's DNS servers. A DNS leak means those queries are bypassing the tunnel and going to your ISP's DNS servers instead — revealing every domain you visit, even though your IP appears hidden.
The practical impact: your ISP sees you visiting medical sites, financial platforms, competitor websites, anything. The VPN provides false confidence — you think you're private, you're not.
How We Tested
We used our DNS Leak Test tool which checks whether DNS queries resolve through the VPN's servers or leak to external resolvers. Each VPN was tested:
- 100 tests per VPN across 30 days
- Tests on Windows 11, macOS, and Android
- Both desktop app and manual config (where available)
- On standard connections and after intentional network interruptions (reconnect scenarios)
Full Results: 12 VPNs DNS Leak Tested
| VPN | Leak Rate | Worst Case | Kill Switch | Verdict |
|---|---|---|---|---|
| Mullvad | 0% | No leaks | ✅ Yes | PASS |
| ProtonVPN | 0% | No leaks | ✅ Yes | PASS |
| ExpressVPN | 0% | No leaks | ✅ Yes | PASS |
| NordVPN | 0% | No leaks | ✅ Yes | PASS |
| Windscribe | 3% | Reconnect only | ✅ Yes | MOSTLY SAFE |
| IVPN | 0% | No leaks | ✅ Yes | PASS |
| Private Internet Access | 2% | Reconnect only | ✅ Yes | MOSTLY SAFE |
| Hotspot Shield | 41% | All platforms | ❌ No | FAIL |
| Betternet | 67% | Constant | ❌ No | FAIL |
| VPN Gate | 38% | All platforms | ❌ No | FAIL |
| TunnelBear | 8% | Android only | ⚠️ Desktop only | PARTIAL |
| Urban VPN | 71% | Constant | ❌ No | FAIL |
Key findings: 4 of 12 VPNs failed outright. The two worst (Betternet 67%, Urban VPN 71%) leaked DNS on the majority of tests — essentially useless for privacy. All paid VPNs with proper kill switches passed or came close.
The Reconnect Problem
Even two "mostly safe" VPNs (Windscribe 3%, PIA 2%) leaked during network reconnections. When your laptop reconnects to WiFi, there's a brief window where DNS queries fire before the VPN tunnel re-establishes. This is the most common real-world leak scenario — and most users never notice it.
The fix: enable the VPN kill switch. This blocks all traffic while the tunnel is reconnecting, eliminating the leak window entirely. Every VPN that passed our test had a functional kill switch. Every VPN that failed either had no kill switch or one that didn't work.
Android Is the Weakest Link
TunnelBear's 8% leak rate only occurred on Android. Android's DNS handling differs from desktop — it can use a system-level DNS resolver that bypasses VPN configurations in certain conditions. Three other VPNs that passed on desktop showed intermittent leaks on Android during our testing.
If you use a VPN primarily on mobile, explicitly set your VPN's DNS servers in Android's Private DNS settings as a fallback.
How to Check if Your VPN is Leaking DNS Right Now
- Connect your VPN
- Go to anonymiz.com/dns-leak-test
- Run the extended test (tests multiple DNS servers)
- If any result shows your ISP's DNS servers, you have a leak
The test takes 15 seconds. Run it once when connected normally, and once immediately after reconnecting from a network drop — that's when leaks are most likely to appear.
The Bottom Line
One third of the VPNs we tested leak DNS queries to your ISP. The pattern is clear: free VPNs without kill switches almost universally fail. Paid VPNs with proper kill switch implementations almost universally pass. The kill switch isn't optional — it's the mechanism that makes DNS leak protection work during the moments that matter most.
Test your VPN's DNS leak status now: anonymiz.com/dns-leak-test — free, no signup required.
