How to Fix a DNS Leak on iPhone and Android
On a phone, the setting that sends your lookups outside the VPN can sit outside the VPN app: in the network settings, the browser, or a DNS app.
🔎 Run the DNS leak test on your phone⚠️ Confirm it before you change anything
Every step below alters how your machine handles connections, and undoing a change you did not need is harder than not making it. Run the test first so you are fixing something that is actually happening, and run it again after each step so you know which one worked.
What this actually is
A DNS leak on a phone works the way it does anywhere: the tunnel carries your traffic, but the question "what is the address of this site" goes to a resolver your VPN does not run. What differs is where the setting hides. On Android, look at Private DNS in the network settings and at secure DNS in the browser. On an iPhone, look for a DNS server typed into one Wi-Fi network, and for an encrypted DNS app or profile that applies to the whole device. Below, each one with the path on both systems.
The resolver answering for you is not operated by your VPN. Whoever runs that resolver sees the name of every site you open, even though the traffic itself is encrypted - which is most of what a tunnel is supposed to hide.
How it shows up
- A DNS leak test on your phone names a resolver that is not your VPN's - Google, Cloudflare, your mobile operator or your home router - while the IP address shows the VPN.
- The leak appears on one Wi-Fi network and not on another, or on Wi-Fi and not on mobile data.
- It started after installing a DNS, ad-blocking or "faster internet" app.
Causes, in the order to check them
Work down the list in order. The first is the quickest to check and to undo, and the later ones only apply once it has been ruled out - which stops you disabling things you never needed to touch.
-
1 Encrypted DNS in the browser is bypassing the tunnel
Check this first: it is one setting and easy to undo. The browser resolves names itself over HTTPS, so the VPN client never sees the query and cannot route it.
On iOS- Apple and Google describe no secure DNS setting for Safari or Chrome on iPhone and iPad. Encrypted DNS there is set for the whole device, by an app or a profile - the next cause.
On Android- Chrome: Settings → Privacy and security → Use secure DNS → turn it off.
- Firefox: Settings → Privacy & Security → DNS over HTTPS → Off.
- Brave: Brave Shields & privacy → Use secure DNS → turn it off.
- Re-run the test. If the resolver changes, this was the cause.
-
2 A system-level resolver override is still in place
It can be left over from earlier troubleshooting, or set by an app, and it survives reconnecting because it sits below the VPN client.
On iOS- Settings → Wi-Fi → the (i) next to your network → Configure DNS. If it says Manual, delete the servers added there, choose Automatic and tap Save. The setting is per Wi-Fi network; there is none for mobile data.
- Settings → General → VPN & Device Management: an encrypted DNS app or a configuration profile shows up here. Turn it off or delete the profile - Apple notes that if the app that made it is still installed, the setting can return.
- Reconnect the VPN and re-run the test.
On Android- Settings → Network & internet → Private DNS → Off → Save. On a Samsung Galaxy: Settings → Connections → More connection settings → Private DNS → Off.
- A provider hostname there (dns.google, for example) sends every lookup to that resolver. Mullvad and Proton both tell users of their apps to turn Private DNS off.
- Reconnect the VPN and re-run the test.
-
3 The tunnel does not supply a resolver of its own
A case for self-hosted and hand-configured connections. Commercial apps push a resolver when they connect; a server that does not leaves the client using whatever it was using before, so the queries travel through the tunnel but are still answered by a third party.
- In the WireGuard app, or any VPN profile you set up yourself, give the tunnel a DNS server; in a commercial app, turn off any custom DNS option.
- Mullvad (2024) and IVPN found in their own testing that Android sends lookups outside the tunnel when the VPN has no DNS server configured - even with Block connections without VPN on.
- Reconnect and re-run this test - the resolver should then sit in the same network as your exit node.
-
4 The router is intercepting DNS
Some ISP-supplied routers redirect all port 53 traffic to their own resolver regardless of device settings.
- Check your router for a "DNS relay", "smart DNS" or parental-filtering feature and disable it.
- If the router cannot be changed, a VPN protocol that carries DNS inside the tunnel avoids the interception entirely.
🔁 Check whether it worked
Run it again after each change rather than at the end. Two steps applied together tell you nothing about which one mattered - and one of them may have been unnecessary.
🔎 Run the DNS leak test on your phoneYour DNS queries are answered outside the tunnel - FAQ
The questions that follow from it.
Does Android's Private DNS cause a DNS leak with a VPN?
It can. Google's help pages do not say what Private DNS does while a VPN is on, but Mullvad and Proton both tell users of their apps to turn it off, and Proton says it can cause a DNS leak. With a provider hostname set, such as dns.google, Android sends every lookup to that resolver - which our test reports as outside your VPN's network. Turn it off, reconnect, and run the test again: if the resolver changes, that was it.
Does "Block connections without VPN" stop DNS leaks on Android?
Not entirely, according to two VPN providers' own testing. Mullvad found in 2022 that Android sends its connectivity checks outside the tunnel even with the setting on, and in 2024 that DNS lookups can go outside it when the VPN has no DNS server configured or is reconnecting; IVPN reproduced the second. We found no statement from Google on whether it has been fixed. Keep the setting on - it blocks everything else - and make sure your VPN has a DNS server.
Does a DNS server I set for my Wi-Fi still apply while the VPN is on?
Apple's help pages do not say. Its documentation for VPN developers says that when a VPN tunnel becomes the default route, the DNS servers the VPN app sets become the default resolver - so a VPN that carries all traffic and sets its own DNS takes over, while one that sets none, or splits the tunnel, can leave lookups to the system. IPVanish says a manually set DNS can cause DNS leaks with its app. The test answers it for your phone: if it names the server you typed in, set that network back to Automatic.
Does iCloud Private Relay leak DNS when my VPN is on?
Apple says it does not mix the two: traffic that goes through a VPN does not use Private Relay. Private Relay is switched under Settings, your name, iCloud, Private Relay, and per network as Limit IP Address Tracking - but for traffic in the tunnel, the VPN's DNS is what the test sees.
🧰 Test it yourself
The tests run in your browser. Where one needs to know whose network an address is on, our server looks it up and keeps no address. Nothing is stored unless you choose to share the result.
📚 Read next
The longer version: what this test is looking for, and what to do with the answer.