How to Fix a DNS Leak
how to fix a dns leak: clear guide, checks, and next steps.
Quick answer
A DNS leak question should become a resolver comparison: run the DNS Leak Test before and after VPN or secure-DNS changes, then save a reduced Privacy Receipt if you need to share the result.
Article to tool flow
DNS results can differ because of ISP DNS, router DNS, browser Secure DNS, public resolvers, VPN DNS, or geolocation mismatch.
A Privacy Receipt is a reduced, share-safe diagnostic summary. It removes raw IP addresses, exact city, full User-Agent, resolver IPs, and WebRTC candidates. It is not proof of anonymity, a VPN provider audit, or a security certificate.
Summary FAQ
What should I do after reading this article?
Run the linked DNS Leak Test first, then compare one related tool if the result does not match what you expected.
What should I save or share?
Use the Privacy Receipt when you need a safe summary. Avoid posting raw IPs, exact location, full User-Agent, resolver IPs, or WebRTC candidate strings publicly.
Does a clean-looking result mean everything is private?
No. MyIPScan checks visible browser/session signals in this context. It helps you find review items, but it does not certify a VPN, device, provider, account, or network.
A DNS leak fix should be verified with the same browser, VPN, and network path before and after the change.
| Fix area | What to change | What to verify |
|---|---|---|
| VPN app | Enable provider DNS and leak protection | The resolver route matches the VPN expectation. |
| Browser | Review secure DNS and profile-specific extensions | The same browser no longer shows the unwanted resolver. |
| Router or OS | Remove stale DNS overrides if they conflict with the VPN | Retest after reconnecting, not just after saving settings. |
What the DNS leak signal means
A DNS leak concern appears when the visible resolver route does not match the privacy setup you expected. In a VPN context, that often means DNS behavior deserves review alongside the public IP route.
MyIPScan treats DNS as a limited resolver-signal diagnostic. It can show visible resolver behavior from the current context, but it is not authoritative packet capture and it does not inspect every app on the device.
Confirm the issue with the diagnostic tool
Start with the DNS Leak Test and note the visible resolver signal before changing settings. If you are comparing a VPN connection, also run the broader VPN Leak Test so the DNS signal is not interpreted without IP, WebRTC, and IPv6 context.
If the DNS result is unclear, DNS Lookup can help you inspect ordinary DNS records separately. That is useful context, but it is not the same as confirming the route your browser uses for DNS resolution.
Check it on MyIPScan: run the DNS Leak Test for the current browser session. Related checks: VPN Leak Test, DNS Lookup.
Check browser, VPN, OS, and network settings
Review browser secure-DNS settings, VPN DNS options, operating-system DNS settings, router DNS settings, and enterprise or network policies that may override local preferences.
Keep the test controlled. Change one setting, reopen or refresh the browser session if needed, and retest before moving to the next setting.
Retest after each change
A fixed result means MyIPScan did not observe the checked DNS review signal in that browser session. It does not prove every DNS leak is absent across every app, device, resolver path, or network.
The Privacy Receipt can summarize safe visible categories after a check. Treat it as a shareable summary, not as proof, a provider audit, or a certificate.
When relevant, use a Privacy Receipt as a safe category summary. It is not a certificate, provider audit, or proof.
What a fixed result cannot prove
Use a simple before-and-after note: baseline result, setting changed, retest result, and whether the visible resolver signal changed. This avoids guessing based on several changes made at once.
If a result changes in one browser but not another, the cause may be browser-specific. If it changes only on one network, the cause may be network or router configuration.
Next step: run the related privacy checks
Run the DNS Leak Test again after each change. Then compare with the VPN Leak Test if you are reviewing a VPN setup, and use DNS Lookup only for domain-record context.
Read the MyIPScan Methodology v1.1 when you need the exact limits behind resolver signals, confidence, exposure scoring, and receipt safety.
Primary check: DNS Leak Test
Related checks: VPN Leak Test, DNS Lookup
Methodology: read MyIPScan Methodology v1.1
How do I confirm a DNS leak before trying fixes?
Run the DNS Leak Test first, record the visible resolver signal, and compare it with the network route you expected for the current session.
Should I change every DNS setting at once?
No. Change one setting at a time and retest. That makes the result easier to interpret.
Can a clean DNS result prove every DNS leak is absent?
No. It means the checked browser/session signal did not show the review condition MyIPScan can observe.
Which related diagnostic should I run next?
Run the VPN Leak Test if you are checking a VPN setup, and use DNS Lookup only for public DNS record context.
What should I save after reviewing the result?
If useful, save a Privacy Receipt as a safe category summary. It is not a certificate or provider-level result.