What DNS actually reveals
Before connecting to many websites, a device needs to resolve a hostname such as example.com to an IP address. Traditional DNS commonly sends these queries without application-layer encryption to a resolver. That resolver can therefore see the domain names requested. DNS does not normally contain the full HTTPS URL path, page content, passwords, or form data.
What people mean by a DNS leak
A DNS leak usually means DNS requests are being sent to a resolver outside the route or privacy configuration the user expected. A common example is a VPN tunnel carrying web traffic while some DNS queries still go to a network provider's resolver. The exact definition depends on the intended configuration, so seeing multiple resolvers is not automatically proof of a privacy failure.
DoH and DoT encrypt the resolver connection
DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS traffic between the client and the selected DNS resolver. This can prevent a local Wi-Fi operator or ISP from directly reading those DNS queries in transit. The chosen resolver can still process the queries, and encrypted DNS by itself does not hide the destination IP addresses used for subsequent connections.
A VPN changes the expected DNS path
Many VPN services provide a DNS resolver and route DNS through the tunnel. If the operating system, browser, another application, or fallback mechanism sends DNS elsewhere, the result may conflict with that privacy model. Split tunneling and browser-specific encrypted DNS can also create multiple legitimate DNS paths, so diagnosis requires knowing the intended setup.
Why a DNS leak test needs careful interpretation
A test can report the resolver infrastructure that appears to answer its specially generated DNS queries. It cannot prove that every DNS query from every application follows the same route. Resolver names can also reflect hosting or upstream infrastructure rather than the consumer ISP you recognize.
DNS privacy is only one layer
Encrypted DNS protects DNS queries on one part of their journey. HTTPS protects web content in transit. A VPN can change network routing. Browser anti-tracking controls address other identifiers. None of these mechanisms alone makes browsing anonymous, and accurate privacy tools should keep those boundaries clear.
Related privacy guides
Frequently asked questions
Does HTTPS prevent DNS leaks?
No. HTTPS encrypts web traffic, while DNS resolution is a separate mechanism. Encrypted DNS or an appropriately configured tunnel is needed to protect DNS queries from ordinary local-network observation.
Can my ISP see DNS queries when I use DoH?
The ISP normally cannot read the encrypted DoH query itself between your client and the DoH resolver, but it can still observe network metadata such as connections to IP addresses.
Does a DNS leak reveal the exact page I visited?
Usually not. DNS deals with domain names, not the full HTTPS path or page contents.
Is seeing more than one DNS resolver always a leak?
No. Multiple resolvers can result from intentional configuration, split networking, browser settings, or resolver infrastructure. A leak is best judged against the route you expected.