VPN leaking DNS on Windows 11: how to find and fix it

Windows 11 can have several DNS paths at once: the system resolver, a browser’s DNS-over-HTTPS setting, a custom resolver, and a VPN application’s intended DNS route. Do not treat any unfamiliar resolver as proof of a VPN DNS leak. This site does not include DNS leak testing; use the VPN test for the public IP comparison and diagnose DNS separately.

Start with the suspected path

An ISP resolver appearing when you expect VPN-provided DNS is worth investigating. A custom public resolver may be intentional. Browser DNS-over-HTTPS can behave separately from Windows resolver settings, so changing Windows DNS alone may not change browser behaviour.

Windows 11 checklist

1. Reconnect the VPN and confirm the correct profile is active.
2. Temporarily disable split tunnelling for the browser being checked.
3. Review the VPN app’s documented DNS and kill-switch settings.
4. Check whether Windows has manual adapter DNS configured.
5. Review browser DNS-over-HTTPS and any security extensions.
6. Restart the affected browser after changing one setting.
7. Check whether a work or school policy controls DNS.
8. Test on another network before assuming the provider is at fault.

What not to do

Changing to a third-party DNS resolver is not a universal fix. It may change who resolves names without confirming that the VPN path is correct, and it can conflict with a provider’s intended configuration. Keep a note of the original setting and make one reversible change at a time.

Verify the broader connection

Use the public IP check before and after reconnecting. If the public IP itself remains unchanged, solve that first with VPN connected but real IP is showing. For provider-selection criteria, see best VPN for DNS leak protection.

Bottom line

Windows DNS questions are often configuration questions, not a single “leak” switch. Establish the resolver path, isolate browser settings, and use the VPN provider’s current documentation for the app you run.