You turned your VPN on, the connection confirmed, and you assumed your browsing was private. But in many cases, one misconfiguration is enough to send your DNS queries straight to your ISP’s servers, completely outside the encrypted tunnel, without any visible sign that something is wrong. Your ISP can see every domain you visit, every app that makes a network request, and every connection your device initiates.
Security research shows that one in four VPN apps on the Google Play Store has DNS leaks. Studies indicate that up to 23% of VPN app leak DNS requests under specific conditions. In most of those cases, the leak does not come from a broken VPN. It comes from a specific configuration mistake that is entirely fixable.
There are five of them. Here is each one, why it causes a leak, and what you do about it.
Why DNS Leaks Are a Specific and Serious Privacy Risk
Every time you visit a website, your device sends a DNS query. It is asking a server to translate a domain name like purevpn.com into the IP address your browser needs to connect. When your VPN works correctly, it routes that query through its own encrypted tunnel and resolves it on its own private DNS servers. Your ISP never sees the question.
When a DNS leak occurs, that query travels outside the tunnel to your ISP’s DNS servers instead. Your ISP can then see which domains you are visiting and when, even if the content of your connection is encrypted. As per VPN usage research, 31% of global internet users actively use VPNs monthly as of 2024. A significant portion of those users may be running configurations that expose their DNS traffic without realising it.
Here are the five configurations responsible for most DNS leaks.
Configuration 1: Your Device Is Still Using Your ISP’s DNS by Default
Most phones, laptops, and tablets come pre-configured to use your internet provider’s DNS servers. That is the factory default on virtually every operating system. When you install a VPN and connect, many devices do not automatically override that setting. The VPN encrypts your traffic, but your DNS queries continue travelling to your ISP’s servers out of habit, through a completely separate path.
The fix: Use a VPN that manages DNS automatically. PureVPN routes your DNS requests through its own private DNS servers the moment you connect, overriding your device’s default configuration. No manual changes are needed on your end.
Configuration 2: Split Tunneling Is Sending Some Traffic Outside the Tunnel
Split tunneling lets you choose which apps or traffic go through the VPN tunnel and which use your regular internet connection directly. It is a useful feature, but it introduces a DNS leak risk when not handled carefully.
Any app or traffic running outside the VPN tunnel makes its own DNS queries through your standard network connection. Those queries bypass your VPN’s DNS servers entirely and go directly to your ISP. You are using a VPN, but a portion of your DNS activity is fully visible.
This is not a flaw in the feature itself. It is the expected behaviour of how traffic separation works. The tunnel only protects what you route through it.
The fix: Be deliberate about what you exclude when using split tunneling. If you are unsure, route all traffic through PureVPN. PureVPN’s built-in DNS leak protection is designed to ensure that DNS queries from tunneled traffic stay inside the encrypted tunnel and do not reach your ISP’s servers.
Configuration 3: Manually Entered DNS Settings Are Pointing the Wrong Way
Some users manually configure DNS settings on their router, operating system, or browser. They might point to a third-party DNS resolver, change settings on one network adapter but not another, or enter incorrect server addresses during setup.
Manual DNS configurations sit outside the VPN’s automatic management. If those settings point to a server the VPN does not control, or if they conflict across different network interfaces, DNS queries can route around the encrypted tunnel entirely, regardless of whether the VPN is connected.
The fix: Remove manual DNS configurations and let PureVPN handle DNS resolution automatically. PureVPN uses its own private DNS servers and manages all DNS traffic inside the encrypted tunnel. You do not need to point your device at any specific resolver address.
Configuration 4: Your ISP May Be Using a Transparent DNS Proxy
Some internet service providers use a technique called transparent DNS proxying. When your device sends a DNS query to an external server, your ISP can intercept that request before it leaves their network and redirect it to their own DNS servers instead. In many cases this happens silently, with no visible indication on your device.
As per security research data, DNS leaks are detected in 12% of free VPNs versus 1% of paid VPNs in 2024. Transparent DNS proxying is one of the network-level factors that can contribute to DNS exposure, particularly in configurations where the VPN does not encrypt DNS queries before they reach the ISP’s infrastructure.
The fix: PureVPN encrypts your DNS requests inside the VPN tunnel before they interact with your ISP’s network. An encrypted DNS query inside an active VPN tunnel is significantly harder to intercept and redirect through a transparent proxy. Your ISP receives an encrypted packet rather than a readable DNS request.
Configuration 5: Your VPN Does Not Have DNS Leak Protection Built In
Not every VPN actively prevents DNS leaks. Some route DNS queries through the tunnel under normal conditions but have no protection mechanism for edge cases. When the tunnel drops briefly, reconnects, or switches between servers, DNS queries can temporarily travel through your regular internet connection during that transition window.
That brief exposure is enough. Your ISP logs it. A DNS leak test will show it.
PureVPN has DNS leak protection built in and enabled by default across all its apps. Every DNS query is designed to go through PureVPN’s own private DNS servers, and the protection is active across connections and reconnections.
- Run PureVPN’s DNS Leak Test now to confirm what your DNS is currently showing.
How to Verify Your DNS Right Now
The check takes less than 30 seconds. Here is the exact process:
- Open PureVPN’s DNS Leak Test
- Run the test without connecting to PureVPN first
- Note which DNS servers and ISP name appear in the results
- Connect to PureVPN
- Run the test again
- The results should now show PureVPN’s DNS servers rather than your ISP’s
If your ISP’s name still appears after connecting, one of the five configurations above is causing the leak. Go back through the list, identify which scenario matches your setup, and apply the corresponding fix.
Fix the Configuration Before Your Next Session
A VPN that shows connected is not the same as a VPN that is working. DNS leaks are invisible. They produce no alert, no warning, and no indication that anything is wrong while your ISP quietly logs every domain you visit.
Five configurations cause the vast majority of DNS leaks. Device defaults, split tunneling, manual DNS misconfiguration, ISP-level proxying, and VPNs without built-in leak protection. Every one of them is fixable, and every one of them starts with knowing whether you have a leak right now.
Arsalan Rashid
March 31, 2026
6 hours ago
