--- title: "DNS Leaks Explained: How Your Location Is Exposed Even Behind a VPN — and How to Restore Your Privacy" description: Learn how to prevent AI agents from leaking sensitive data with layered security protections, ensuring your AI remains helpful without compromising your secrets. image: https://codenotary.com/hubfs/DNS.png --- **$ protect --distro linux --machines 25 --free** [Start now](https://apps.codenotary.com/linux) [![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/) - Product #### [![AgentMon Start](https://codenotary.com/hubfs/AgentMon%20Start.svg) **AgentMon Start** Organization-wide AI agent spend, security and device fleet TRY NOW →](https://apps.codenotary.com/agentmon-start) #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon) #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control) #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust) - Use Cases #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk) #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops) #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance) #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost) #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security) #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit) - [Blog](https://codenotary.com/blog) - [Press](https://codenotary.com/press) - Resources #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations) #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com) #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success) #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn) [Login](https://apps.codenotary.com/auth/login) [All posts](https://codenotary.com/blog/all) Jan 02, 2026 # DNS Leaks Explained: How Your Location Is Exposed Even Behind a VPN — and How to Restore Your Privacy By  [blog](https://codenotary.com/blog/author/blog)  ·  3 minute read A VPN encrypts your traffic and routes it through a remote server, masking your public IP address. However, if your DNS queries bypass the VPN tunnel and go directly to your ISP’s resolver, you are experiencing a DNS leak. This undermines the privacy guarantees of your VPN. ## ![DNS](https://codenotary.com/hs-fs/hubfs/DNS.png?width=800&height=565&name=DNS.png) ### What Is DNS? The **Domain Name System (DNS)** translates human-readable domain names (e.g., example.com) into IP addresses. When you visit a website: 1. Your system queries a DNS resolver. 2. The resolver returns the IP address. 3. Your browser connects to that IP. If this DNS query goes outside the encrypted VPN tunnel, your ISP (or any observer) can see: - The domains you are accessing - Your real IP address - Your approximate geographic location Even if the actual HTTP/HTTPS traffic is tunneled. ### How a DNS Leak Reveals Your Location Suppose: - Your VPN endpoint is in Switzerland. - Your real location is Texas. - Your system uses your ISP’s DNS (e.g., AT&T or Spectrum). Even though your browser traffic exits via Switzerland, your DNS requests still go to your Texas-based ISP resolver. This creates a metadata correlation: - DNS query from Texas IP - Traffic shortly after from Swiss VPN exit node DNS servers often log: - Client IP - Query timestamp - Queried domains This is sufficient to infer your true location. ## ![](https://codenotary.com/hs-fs/hubfs/undefined-1.png?width=800&height=556&name=undefined-1.png) ### Why DNS Leaks Happen Common causes: - OS configured to use ISP DNS statically - VPN client not pushing DNS settings - Split tunneling enabled - IPv6 not tunneled by VPN - Systemd-resolved or NetworkManager overriding VPN DNS ## How to Test for a DNS Leak #### **Method 1: Web-based Test** Visit: - [https://dnsleaktest.com](https://dnsleaktest.com) - [https://ipleak.net](https://ipleak.net) If you see your ISP’s DNS servers instead of your VPN provider’s DNS servers — you are leaking. #### **Method 2: Command-Line Test** Run: dig +short myip.opendns.com @resolver1.opendns.com Then check which DNS server is being used: cat /etc/resolv.conf Or: nmcli dev show | grep DNS If DNS servers belong to your ISP — you are leaking. ## How to Prevent DNS Leaks The goal is: Force all DNS queries through the VPN tunnel and prevent fallback to ISP DNS. ## ![](https://codenotary.com/hs-fs/hubfs/undefined-2.png?width=800&height=556&name=undefined-2.png) ## Linux (NetworkManager + systemd-resolved) ### **Step 1: Force VPN to Push DNS** If using OpenVPN: Edit your .ovpn file and add: block-outside-dns dhcp-option DNS 10.8.0.1 (Use your VPN’s internal DNS server.) ### **Step 2: Prevent systemd from Using ISP DNS** Edit: sudo nano /etc/systemd/resolved.conf Set: DNS= FallbackDNS= Then restart: sudo systemctl restart systemd-resolved ### Step 3: Lock DNS to VPN Interface Only Using nmcli: List connections: nmcli connection show Modify your VPN connection: nmcli connection modify \ ipv4.ignore-auto-dns yes nmcli connection modify \ ipv4.dns "10.8.0.1" nmcli connection modify \ ipv6.ignore-auto-dns yes Bring connection down/up: nmcli connection down \ nmcli connection up \ #### **Optional: Block Non-VPN DNS with Firewall** sudo iptables -A OUTPUT ! -o tun0 -p udp --dport 53 -j DROP sudo iptables -A OUTPUT ! -o tun0 -p tcp --dport 53 -j DROP This ensures DNS cannot exit outside tun0.   ## Windows 10 / 11 ### **Step 1: Disable ISP DNS** Open: Control Panel → Network and Internet → Network Connections Right-click your physical adapter → Properties Select: **Internet Protocol Version 4 (TCP/IPv4)** Click Properties → Advanced → DNS tab Uncheck: Register this connection's addresses in DNS ### **Step 2: Force VPN DNS** After VPN is connected: Open PowerShell as Administrator: Get-DnsClientServerAddress If wrong DNS servers appear, set VPN interface DNS manually: Set-DnsClientServerAddress -InterfaceAlias "VPN" -ServerAddresses 10.8.0.1 ### **Step 3: Disable Smart Multi-Homed Name Resolution** Windows may leak DNS via parallel queries. Run: Set-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient" -Name DisableSmartNameResolution -Value 1 Reboot.   ## **macOS** macOS frequently overrides VPN DNS unless forced. ### **Step 1: Check Current DNS** scutil --dns ### **Step 2: Set DNS on VPN Interface** List services: networksetup -listallnetworkservices Assume VPN is named “VPN”. Set DNS: sudo networksetup -setdnsservers "VPN" 10.8.0.1 ### **Step 3: Prevent Wi-Fi from Using ISP DNS** sudo networksetup -setdnsservers Wi-Fi empty ### **Step 4: Flush DNS Cache** sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder   ## **Advanced: Disable IPv6 (Optional)** Many VPNs do not tunnel IPv6. ### **Linux:** sudo sysctl -w net.ipv6.conf.all.disable\_ipv6=1 ### **Windows:** Disable-NetAdapterBinding -Name "Ethernet" -ComponentID ms\_tcpip6 ### **macOS:** networksetup -setv6off Wi-Fi   ## **Final Verification** After applying fixes: 1. Reconnect VPN 2. Visit[https://dnsleaktest.com](https://dnsleaktest.com) 3. Confirm: Also verify: dig example.com Ensure DNS server shown is VPN internal.   ## **Summary** A DNS leak defeats the core privacy promise of a VPN. It exposes: - Your real IP - Your ISP - Your geographic region - Your browsing metadata The solution is straightforward: - Force VPN DNS servers - Disable ISP fallback DNS - Block DNS traffic outside VPN interface - Disable Smart DNS features - Consider disabling IPv6 if unsupported Once configured correctly, your DNS resolution becomes fully encapsulated inside the encrypted tunnel — restoring actual anonymity rather than just encrypted transport. If desired, I can also provide a hardened configuration checklist suitable for enterprise Linux deployments. [![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy&utm_medium=social&utm_source=pinterest&media=) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "blog", "url" : "https://codenotary.com/blog/author/blog" }, "dateModified" : "2026-02-16T11:03:18.890Z", "datePublished" : "2026-01-02T08:00:00.000Z", "headline" : "DNS Leaks Explained: How Your Location Is Exposed Even Behind a VPN — and How to Restore Your Privacy", "image" : [ "https://codenotary.com/hubfs/DNS.png" ], "mainEntityOfPage" : { "@id" : "https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://codenotary.com/hubfs/logo-light.svg" }, "name" : "Codenotary, Inc." } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "blog" ], "url" : "https://codenotary.com/blog/author/blog" }, "datePublished" : "2026-01-02T08:00:00+0000", "description" : "Learn how to prevent AI agents from leaking sensitive data with layered security protections, ensuring your AI remains helpful without compromising your secrets.", "headline" : "DNS Leaks Explained: How Your Location Is Exposed Even Behind a VPN — and How to Restore Your Privacy", "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/DNS.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg" }, "name" : "" }, "url" : "https://codenotary.com/blog/dns-leaks-explained-how-your-location-is-exposed-even-behind-a-vpn-and-how-to-restore-your-privacy" } ```