A DNS leak refers to a security flaw that allows

DNS The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...

requests to be revealed to

ISP An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise private ...

DNS servers, despite the use of a

VPN A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...

service to attempt to conceal them. Although primarily of concern to VPN users, it is also possible to prevent it for proxy and direct internet users.

Process

The vulnerability allows an ISP, as well as any on-path eavesdroppers, to see what websites a user may be visiting. This is possible because the browser's DNS requests are sent to the ISP DNS server directly, and not sent through the VPN. This only occurs with certain types of VPNs, e.g. "split-tunnel" VPNs, where traffic can still be sent over the local network interface even when the VPN is active. Starting with Windows 8, Microsoft has introduced the "Smart Multi-Homed Named Resolution". This altered the way Windows 8 handled DNS requests, by ensuring that a DNS request could travel across all available network interfaces on the computer. While there is general consensus that this new method of domain name resolution accelerated the time required for a DNS look-up to be completed, it also exposed VPN users to DNS leaks when connected to a VPN endpoint, because the computer would no longer use only the DNS servers assigned by the VPN service. Instead the DNS request would be sent through all available interfaces, thus the DNS traffic would travel out of the VPN tunnel and expose the user's default DNS servers.

Prevention

Websites exist to allow testing to determine whether a DNS leak is occurring. DNS leaks can be addressed in a number of ways: * Encrypting DNS requests with

DNS over HTTPS DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-i ...

DNS over TLS DNS over TLS (DoT) is a network security protocol for encrypting and wrapping Domain Name System (DNS) queries and answers via the Transport Layer Security (TLS) protocol. The goal of the method is to increase user privacy and security by prevent ...

, which prevents the requests from being seen by on-path eavesdroppers. * Using a VPN client which sends DNS requests over the VPN. Not all VPN apps will successfully plug DNS leaks, as it was found in a study by the Commonwealth Scientific and Industrial Research Organisation in 2016 when they carried an in-depth research called "An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps" and found that 84% of the 283 VPN applications on

Google Play Store Google Play, also known as the Google Play Store and formerly the Android Market, is a digital distribution service operated and developed by Google. It serves as the official app store for certified devices running on the Android operating sys ...

that they tested did leak DNS requests. * Changing DNS servers on local computer for whole network adapters, or setting them to different ones. 3rd party apps are available for this such as NirSoft quicksetdns. * Using a

firewall Firewall may refer to: * Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts * Firewall (construction), a barrier inside a building, designed to limit the spre ...

to disable DNS on whole device (usually outgoing connections UDP and less commonly TCP port 53), or setting dns servers to non-existing ones like local 127.0.0.1 or 0.0.0.0 (via command line or 3rd party app if not possible via OS GUI interface). This requires alternate ways of resolving domains like the above mentioned ones, or using in apps with configured proxy, or using proxy helper apps like Proxifier or ProxyCap, which allows resolving domains over proxy. Many apps allow setting manual proxy or using proxy already used by system. * Using completely anonymous web browsers such as

Tor Browser Tor, short for The Onion Router, is free and open-source software for enabling anonymous communication. It directs Internet traffic through a free, worldwide, volunteer overlay network, consisting of more than seven thousand relays, to conc ...

which not only makes user anonymous, but also doesn't require any dns to be set up on the operating system. * Using proxy or vpn, system wide, via 3rd party app helpers like Proxifier, or in form of web browser extension. However most extensions in Chrome or Firefox will report false positive working condition even if they did not connect, so 3rd party website for ip and dns leak check is recommended. This false working state usually happens when two proxy or vpn extensions are tried to be used at the same time (e.g. Windscribe VPN and FoxyProxy extensions).

References

{{Reflist Virtual private networks Internet privacy Computer security exploits