Definition
A DNS leakage (often shortened to “DNS leak”) is a situation where your device’s DNS lookups are sent to a DNS resolver in a way that you did not intend—so the resolver you end up using may be different from what you expected.
DNS lookups are the process of translating a domain name (like example.com) into an IP address. If those queries reach a resolver that is observable to someone you didn’t plan for, the domain names involved can become part of what can be seen.
A simple model of how it happens
Think of DNS leakage as a mismatch between:
- what you assume will handle DNS queries, and
- what actually receives the queries.
That mismatch can occur when DNS requests “fall back” to a different path or resolver than intended. Common examples include network settings that still point to an external DNS server, client settings that behave differently for IPv4 vs. IPv6, or multiple network interfaces where one interface handles name lookups.
The key idea: a DNS leak is less about “encryption” of web traffic and more about where the DNS query goes and who can potentially observe it.
What a DNS leak can and cannot reveal
A DNS query mainly reveals the domain being looked up (and often metadata around the request). It does not automatically reveal the full page content that you later load, because web traffic uses separate connections and may be protected differently.
However, knowing which domains are queried can still matter. Depending on your threat model, domain names can indicate interests, services used, or destinations you access.
A limitation to keep in mind: the exact amount of information exposed varies by environment, network configuration, and how the DNS query is handled end-to-end.
Differences and limits: leak vs. “working correctly”
You may see the term used loosely, so it helps to define it operationally.
- If your DNS queries consistently go through the resolver you expect, you can say there is no DNS leak in that scenario.
- If DNS queries reach a resolver you did not expect (for example, by using a different resolver than you intended), that mismatch is consistent with a DNS leak.
Also, “no leak” is not a universal guarantee across every possible path in your setup. DNS behavior can differ between protocols (such as IPv4 and IPv6) and between network interfaces (such as Wi‑Fi vs. a second interface).
Because there are multiple ways to implement DNS handling in software and networks, the practical meaning of “leak” depends on what you expected to happen.
How to check in practice (without overpromising)
You can reason about DNS leakage by verifying two things:
- Which DNS resolver your device actually uses for queries in your current network conditions.
- Whether both IPv4 and IPv6 name resolution follow the same intended handling.
In practice, people often use DNS-detection or DNS-check style tests (typically via a web-based check or network inspection). Treat results as evidence about your current connection state, not as a permanent property of your device or network.
If you find a mismatch, the right next step is usually to review DNS-related settings at the client level (and sometimes at the network/router level) so that DNS queries reliably follow the path you intend.
Bottom line
A DNS leakage occurs when DNS queries are routed to a DNS resolver you didn’t expect, which can expose domain lookups. Whether it is a problem depends on what you aim to protect and which parts of traffic visibility matter in your threat model.