What is a DNS leak?

Even when using a VPN or Tor, if DNS handling is overlooked, clues about the domain names you tried to connect to may go out through a different route.

This is called a DNS leak.

A DNS leak is a little different from a problem where the communication content itself is read. The issue is the clue it gives about which site someone tried to visit.

For example, even if you think you have changed the communication route with a VPN, if only DNS queries are sent to the DNS resolver of your usual ISP, the ISP side may be able to see the queried domain names.

This article organizes what is visible in a DNS leak, how it relates to VPNs and Tor, and what to look at when checking.

DNS is the mechanism for looking up the destination

DNS is the mechanism that maps domain names to IP addresses.

When opening a website in a browser, humans use domain names. However, to actually communicate on the network, the destination IP address is needed.

For that reason, the device or browser asks a DNS resolver and looks up the IP address corresponding to the domain name.

A DNS query is not the page content or form content itself. However, "which domain name was looked up" becomes a strong clue for inferring the access destination.

What is the problem with a DNS leak?

The problem with a DNS leak is that even though you think the communication route has changed, only DNS queries go out through a different route.

For example, suppose the purpose of using a VPN is "making the destination harder for the ISP to see directly." In that situation, even if web communication is going to the VPN server, if only DNS queries go to the ISP side, the ISP may be able to see the queried domain names.

In other words, even if the destination website content is hard to read because of HTTPS, the DNS stage may still leave behind "which domain someone tried to view."

A DNS leak is easy to miss if you assume, "because I am using a VPN, the destination is not visible."

For anonymity, the web communication route and the DNS query route need to be checked separately.

It often needs attention when using a VPN

DNS leaks are especially considered when using a VPN.

A VPN creates a communication path from the device to the VPN server, then communicates outward through that server. To the destination website, the user appears to come from the VPN server's IP address, not the home IP address.

However, if DNS query settings have not changed to match the VPN, only DNS may go out through the usual network.

In that state, even if the IP visible to the destination website is the VPN server, the queried domain names remain on the DNS resolver side.

If you use a VPN, check DNS as well as the IP address. "The IP visible to the destination changed" alone does not prove that there is no DNS leak.

Relationship with Tor

When using Tor Browser, the way to think about this differs from ordinary web browsing.

Tor Browser is designed to handle communication through the Tor network. For that reason, name resolution for websites accessed inside Tor Browser needs to be considered separately from an ordinary browser.

However, if apps other than Tor Browser or your usual browser communicate over the usual network connection, their DNS queries remain a separate issue.

In other words, even if you use Tor, not all communication from the whole device automatically goes through Tor. You need to check which app is sending the communication you want to anonymize.

Information visible and not visible in a DNS leak

To understand DNS leaks correctly, separate what is visible from what is not visible.

A DNS leak is not a problem where all page contents leak. However, for anonymity, "which domain someone tried to visit" alone can be an important clue.

In particular, when combined with time, IP address, VPN connection logs, posting time, and account behavior, it becomes material for correlation.

What to check

When checking for DNS leaks, compare the information visible before and after VPN connection.

If you use an external DNS leak test site, look at whether the displayed DNS server is the usual ISP side, the VPN side, or browser-specific DNS.

However, do not judge that you are completely safe from the results of a test site alone. Results change depending on the test scope, browser, OS settings, VPN app, and connection timing.

DNSLeakTest is a verification site that can check DNS resolver information as seen from outside. Comparing displayed results before and after VPN connection makes it easier to check whether DNS queries are going through the intended route.

URL : https://www.dnsleaktest.com/

For high-risk anonymous activity, do not feel reassured by a DNS leak check alone. Check cookies, login state, browser fingerprinting, post content, and file metadata separately too.

Summary

A DNS leak means that even though you think the communication route has changed, DNS queries go out through an unintended route.

DNS is not a mechanism that handles page bodies. However, queried domain names become clues to which site someone tried to connect to.

Even when using a VPN, if only DNS goes to the ISP side, material for inferring the destination remains. When using Tor Browser too, communication from apps outside Tor Browser or from a normal browser needs to be considered separately.

For anonymity, check not only the IP address, but DNS, cookies, login state, browser, and post content together. DNS leak countermeasures are important, but they do not make anonymity complete by themselves.

Related tools

Related articles