What is a DNS Leak?

A DNS leak is a security flaw that occurs when requests are sent to an ISP's DNS servers even when a VPN is being used to protect users. A VPN is designed to encrypt a user’s internet connection, which keeps their traffic in a private tunnel that hides all of their browsing activity. That means all the user’s internet searches and website visits are hidden from everyone except for their VPN provider. 

However, a DNS leak occurs when the user’s DNS requests move outside the encrypted tunnel and become visible to their ISP. As a result, all their browsing activity, including their IP address, location, and web searches, goes through the ISP in the same way it would if they were not using a VPN.

There are several situations that can result in a DNS leak occurring, including:

1. An improperly configured VPN: A DNS leak is most likely to occur when a VPN is configured improperly and assigns a DNS server belonging to the user’s ISP. VPNs require a user to connect to their ISP before they log in to the VPN, so this is likely to occur when users regularly use multiple networks.
2. An ineffective VPN service: A VPN service that does not have its own DNS servers will result in DNS leaks occurring and will fail to provide effective protection from DNS leaks.
3. No Internet Protocol version 6 (IPv6) support: IP addresses were originally 32-bit Internet Protocol version 4 (IPv4) addresses with four sets of three digits. But 128-bit IPv6 addresses have been created to extend the pool of IP addresses and accommodate more devices. The internet is still transitioning, and some VPNs may not support IPv6, which may push a user’s DNS request outside of the encrypted tunnel.
4. Transparent DNS proxies: Some ISPs have started forcing customers to use their DNS servers even when they change their settings to a third-party VPN. If the ISP detects DNS setting changes, it uses a transparent proxy that forces a DNS leak by redirecting the user’s web activity to its own DNS servers.
5. Windows smart features: Microsoft introduced a feature known as Smart Multi-Homed Name Resolution (SMHNR) in devices using operating systems from Windows 8 onwards. The feature submits DNS requests to available servers and accepts whichever DNS server responds first. This can cause a DNS leak and leave users open to spoofing attacks.
6. Windows Teredo: Windows operating systems include a built-in feature called Teredo that aims to ease the transition from IPv4 to IPv6. It helps the two IP systems coexist more easily but creates a huge security issue for VPN users. That is because Teredo is also a tunneling protocol that can take precedence over a user’s encrypted VPN tunnel. 

A standard DNS leak can be fixed by configuring a VPN to only connect to its own DNS servers. This will force a computer to only use the VPN’s DNS servers and not connect to the user’s ISP.  

In the case of the Windows SMHNR issue, this can be more tricky because it is built into the operating system. Some VPN providers enable Windows 8 and Windows 10 VPN users to install a free plugin that resolves the issue, while other users will need to contact their VPN for support.

Understanding what is DNS leak is the first step toward ensuring it does not happen. Because a DNS leak involves your information getting leaked outside the confines of your VPN, one way to prevent it is to properly configure your VPN server. In this way, you can still use the internet anonymously without revealing your IP address. Also, make sure your VPN has features that protect you from DNS leaks.

Learn more about DNS Firewall here.  

You can also reduce the probability of DNS leaks by setting up your own private VPN in a different country whose internet service providers are less likely to leak your information. While this does not guarantee that no leaks will occur, it can make them less frequent.

Using an anonymous web browser is another technique that can prevent DNS leaks. For example, you can use a browser like Tor, which does not require any DNS configuration on the operating system end. This gives you total anonymity while browsing.

Another DNS leak fix is to use a firewall. Firewalls can be set up to prevent data from leaving your computer, including information involved in DNS requests. This can be effective because a firewall can disable the DNS process, which prevents your information from exiting your computer.

You may also configure your DNS server to one that does not really exist, such as 0.0.0.0 or 127.0.0.1. This can be done using a UNIX/Linux terminal or a graphical user interface (GUI), but you may have to figure out another way to resolve your domain names while using the internet. One method is to use a proxy. A proxy is positioned in front of your browser, and it handles requests on your behalf. It has its own IP address and uses this during the DNS process so your computer's IP address stays private.

Tools designed for DNS leak checks help you know whether you are susceptible to DNS leaks. They work by checking which servers are used to resolve domain names when you enter the address of a website. After the test, you see which servers are getting access to your information. If any of the servers that appear are not the ones you expect, then you have a DNS leak.

Here are some free DNS leak tools you can use:

• whoer.net
• ipleak.net
• dnsleak.com
• dnsleaktest.com