SentryFi- SentryFi
- DNS guides
- DNS leaks
DNS
Is my DNS leaking?
A DNS leak is when your address lookups go somewhere you didn’t intend, usually around your VPN. It reveals which sites you visit to that network.
You have a DNS leak if your lookups are answered by a DNS provider you didn’t choose, typically the local WiFi or mobile network, while you expect your VPN or encrypted DNS to handle them. A leak doesn’t expose page content, but it shows the network which sites you look up. To check, see which provider answers your lookups with your VPN on; if it’s the local network, turn on your VPN’s DNS protection or a Private DNS provider.
When a leak matters
- You use a VPN on public WiFi to keep the venue from seeing your traffic.
- You set encrypted DNS (Android Private DNS or an iPhone DNS profile) and expect all lookups to use it.
How to check
- Connect your VPN (or set your encrypted DNS).
- Run a check that shows which DNS provider is answering: SentryFi’s report names the provider it detects (for example Cloudflare, Google, Quad9 or your network/provider).
- If the provider is the local network or your internet provider instead of your VPN or chosen resolver, lookups are leaking.
Fixes
| VPN | Turn on the app’s DNS leak protection or “use VPN DNS”; update the app. |
|---|---|
| Android | Set Private DNS to a provider hostname for consistent encrypted DNS (pause it for hotel sign-in pages). |
| iPhone | Check Settings > General > VPN & Device Management for the profile you expect; iCloud Private Relay covers Safari. |
Not every “leak” is a problem: without a VPN or encrypted DNS, using the network’s DNS is the normal default.
Frequently asked questions
Is a DNS leak dangerous?
It’s a privacy issue rather than a direct attack: the network sees which sites you look up. It matters most when you rely on a VPN for privacy.
Can a DNS leak happen without a VPN?
Without a VPN or encrypted DNS, the network’s DNS is the default, so there’s nothing to leak from. The question is whether the answers are honest; see our DNS hijacking guide.
Does iCloud Private Relay prevent DNS leaks?
It handles DNS for Safari and some traffic, not every app. A full-device VPN or DNS profile covers more.
