DNS leak protection

Updated 21 September 2026 · How we research

A DNS leak means your traffic is encrypted but your lookups are not. The tunnel carries the data while your device quietly asks your ISP's resolver which address to connect to — handing over a list of every site you visit.

DNS leak protection: what changes

The page request may be encrypted while the DNS lookup still reveals the destination domain.

Without DNS leak protection
DEVICEDNS query outside tunnelISP DNSsees domain
Exposure
The resolver can associate queried domains with the user's network connection.
A VPN icon alone does not prove DNS privacy.
With VPN DNS protection
DEVICEQuery follows protected routeVPN DNSinside route
Expected result
The ISP resolver is not used for the lookup, subject to correct app and OS configuration.
Verify with repeatable IPv4, IPv6 and WebRTC tests.

ZoogVPN documents DNS leak protection in its apps; VPN Sherlock should publish observed test conditions before claiming test results.

Left: the query escapes to the ISP resolver. Right: the query travels inside the tunnel.

Three leaks with different causes

These are separate problems. Passing a DNS test says nothing about the other two.

Leak	Cause	Fix
DNS leak	The OS sends lookups to a resolver outside the tunnel. Windows is prone to this because it may query every interface at once and use whichever answers first.	The client must set the tunnel's resolver and block queries to any other.
IPv6 leak	The tunnel carries IPv4 only, but the OS prefers IPv6 and sends that traffic over the normal connection.	The client must either carry IPv6 through the tunnel or disable it while connected.
WebRTC leak	A browser API discovers local and public addresses for peer-to-peer connections and exposes them to a page through ICE candidates.	Browser-level: disable or restrict WebRTC, or use an extension. A VPN alone does not fix this.

WebRTC is a browser problem

No VPN can fully close a WebRTC leak on its own, because the leak happens inside the browser before traffic reaches the network stack. Any provider claiming otherwise is overstating what is technically possible. Check it in the browser you actually use.

How to check

Note your real IP address and ISP before connecting.
Connect to a VPN server in a different country.
Run a DNS leak test and confirm every resolver shown belongs to the VPN, not your ISP.
Run an IPv6 check and confirm either no IPv6 address is shown or it belongs to the VPN.
Run a WebRTC check in each browser separately — results differ between them.
Repeat after forcing a reconnect, which is when leaks most often appear.

What ZoogVPN states

According to ZoogVPN

ZoogVPN says: "When you are using ZoogVPN apps, we protect you from DNS leaks. Our applications are configured in a way that makes it impossible for ISP to send DNS queries," and that it resolves domains using other DNS servers. Its leak-protection page does not specifically address IPv6 or WebRTC leaks, and we have not independently tested any of these behaviours.

Because IPv6 and WebRTC are not covered by that statement, verify them yourself using the steps in how to test a VPN.

Frequently asked questions

What is a DNS leak?

Your traffic goes through the VPN tunnel but your domain lookups go to a resolver outside it, usually your ISP's, revealing which sites you visit.

Can a VPN stop WebRTC leaks?

Not completely. WebRTC exposes addresses from inside the browser, so the reliable fix is a browser setting or extension.

Why do leaks appear after reconnecting?

During a reconnect the virtual interface disappears briefly and the OS may fall back to its default resolver. A firewall-level kill switch is what prevents this.