My VPN is on but the leak test shows my internet provider. Is my VPN broken?

Not necessarily. DNS leak protection may simply be disabled in your VPN settings, so enable it and run the test again. If it's already enabled and you're still leaking, try reconnecting to a different server, and if that doesn't help, contact your VPN provider's support team; it's a known issue they'll have a fix for.

Does a kill switch fix DNS leaks?

No, they solve different problems. A kill switch cuts your internet if the VPN connection drops, stopping unprotected traffic from getting through. A DNS leak can happen even while the VPN is fully connected and working. You need DNS leak protection specifically, which is usually a separate setting in your VPN app.

Will a DNS leak let streaming services see what I'm watching?

A DNS leak can reveal your real location to streaming services, which is why they can block you even when your VPN looks active. Your internet provider can also see which sites you're visiting, though not the content of what you're watching.

Does every VPN have DNS leak protection?

Most good paid VPNs do. Free VPNs often don't, which is one reason they tend to be unreliable for streaming; our guide on whether free VPNs are actually safe covers this gap in more detail. If your VPN has no leak protection settings, switch to one that does.

I fixed the leak but iPlayer still blocks me. What next?

If the DNS leak is fixed and your IP is showing as a UK VPN server, WebRTC in your browser is another common cause. Try the iPlayer app instead of a browser: this sidesteps WebRTC entirely. Switching to a different server can also help if the current one's IP has been flagged by iPlayer.

Can a DNS leak affect anything other than streaming?

Yes. If you're using a VPN for privacy, a DNS leak means your internet provider can still see which sites you visit, even if they can't read the content of what you're doing there. Fix it even if streaming isn't your main concern.

Should I use dnsleaktest.com or ipleak.net?

Either is fine as a starting point, and both are free. If a result looks unexpected or unclear, running the test on both sites is a quick way to confirm it rather than relying on a single reading.

I've set up split tunnelling and now the leak test shows my real DNS. Is that a leak?

Not necessarily. If the app or browser you're testing with is deliberately excluded from the VPN under your split tunnelling settings, seeing your real DNS there is expected, not a fault. Test using an app that's actually routed through the VPN to get an accurate reading.

What Is a DNS Leak and How to Fix It

If your VPN is running but a streaming service is still blocking you, a DNS leak is one of the most common culprits. It happens when your device quietly sends location requests outside the VPN, so sites can still see where you really are even though your IP address looks fine. The good news is it's usually a one-setting fix.

What DNS actually is

Every time you type a web address like netflix.com into your browser, your device needs to find the actual server that hosts that site. DNS (the Domain Name System) is the directory that translates human-readable names into the server addresses your computer actually uses. Think of it like a phone book: the website name is the person's name, and the DNS server looks up the number.

Normally, your internet provider runs the DNS servers your device uses. This means your internet provider can see every site you visit, even if they can't read the content. When you use a VPN, your DNS requests should go through the VPN's own servers instead, keeping them hidden from your internet provider.

What a DNS leak is

A DNS leak happens when your device sends DNS requests outside the VPN, directly to your internet provider's servers, even though your other traffic is going through the VPN. From the outside, your IP address looks like it belongs to the VPN server, but your DNS requests are coming from your home location.

Some streaming services check both your IP address and your DNS requests. If your IP says you're in the Netherlands but your DNS requests are coming from a Virgin Media server in Birmingham, the service can tell something is off and block you.

A DNS leak also affects your privacy more broadly, since your internet provider can still see which sites you're visiting even with the VPN running.

How to test for a DNS leak

The test takes about 30 seconds. With your VPN connected:

Go to ipleak.net, a free DNS leak test tool.
Run the extended test.
Look at the results. The only DNS servers listed should belong to your VPN provider. Their name and location should match your VPN, not your home internet provider.

If the results show your home internet provider (Virgin Media, BT, Sky, or another provider) alongside or instead of your VPN, you have a DNS leak.

You can also use our IP address checker to confirm your VPN is masking your IP correctly. If it shows your home country rather than your VPN's location, the VPN connection itself may not be working properly.

How to fix a DNS leak

For most people, it's a single toggle inside the VPN app:

Enable DNS leak protection. In NordVPN, look in Settings for a DNS leak protection option. In ExpressVPN, DNS protection is handled automatically when you connect and there's nothing to change. In PureVPN, check under Settings for an Internet Security or Privacy section. Turn it on, reconnect your VPN, and run the leak test again.

Most DNS leaks are fixed with a single setting. Enable DNS leak protection in your VPN app, reconnect, and run the test again.

If your VPN doesn't have a leak protection setting, or if enabling it doesn't resolve the leak, you can manually set your DNS servers. This is more technical and most people won't need it, but it works:

On Windows: go to Network & Internet Settings and look for DNS server settings in your network adapter properties. The exact path varies depending on your Windows version. Enter DNS server addresses from your VPN provider's support documentation.
On macOS: System Settings > Network > select your connection > Details > DNS. Add the servers there.
On iOS/Android: your VPN app should handle this automatically. If you're still leaking on mobile, reinstall the VPN app and make sure it has the permissions it needs to modify your network settings.

One thing worth checking on Android specifically: if you have a Private DNS provider set manually (under Settings > Network & internet > Private DNS), it can sometimes override your VPN's own DNS routing on certain Android versions. If you've enabled your VPN's built-in leak protection and you're still leaking, set Private DNS to "Automatic" or off, then test again.

What about DNS over HTTPS?

Browsers have their own DNS option called DNS over HTTPS (DoH), which encrypts DNS requests at the browser level. Chrome and Firefox both support it. It's a useful privacy layer, but it's separate from your VPN's DNS leak protection and doesn't replace it.

If your VPN is leaking DNS, enabling DoH in your browser won't fix streaming issues, because streaming apps don't go through the browser's DNS settings. Fix the VPN leak first.

IPv6 leaks: worth checking at the same time

Most leak test tools also check for IPv6 leaks. IPv6 is the newer version of the internet address system, and some VPNs that handle standard IPv4 traffic correctly don't always cover IPv6.

If the test shows an IPv6 address belonging to your internet provider, look for an IPv6 leak protection setting in your VPN app. Most modern VPNs include this. If yours doesn't, you can disable IPv6 on your device entirely through your network settings on both Windows and macOS.

Which DNS leak test should I use?

ipleak.net is the one we usually point people to because it's quick and free, but it's not the only option. dnsleaktest.com is another well-regarded free tool that works the same way: run it with your VPN connected and check whether your own internet provider shows up anywhere in the results.

If you want to be extra thorough, running the test on two different sites and getting the same result on both rules out a fluke or a temporary glitch with one particular tool.

Split tunnelling can look like a leak but isn't one

If you've set up split tunnelling to deliberately exclude certain apps or sites from the VPN, those excluded apps will show your real DNS and IP address, and that's expected behaviour, not a leak. A genuine DNS leak happens when traffic that's supposed to be going through the VPN sneaks out anyway.

Before assuming you have a leak, double-check your split tunnelling settings to make sure the app or browser you're testing with isn't deliberately excluded from the tunnel.

Router-level VPNs and DNS leaks

If you've set your VPN up on your router so it covers your whole home network, DNS leak protection works a little differently, since there's no app running on each individual device to manage it. The router itself needs to be configured to use your VPN provider's DNS servers rather than your internet provider's default ones.

This is usually handled during the router VPN setup process, but it's worth checking your router's DNS settings directly if a leak test gives you a result that doesn't match what you'd expect. Router firmware varies a lot between manufacturers, so the exact menu location isn't something we can give one universal answer for; your VPN provider's own router setup guide is the most reliable source for this.