Last Updated on September 16, 2026 by Steve Salinas
Your VPN can show Connected and still leak the exact detail streaming services use to spot you: the location of your DNS resolver. A DNS leak sends every domain lookup outside the encrypted tunnel, so your provider sees the sites you open and the player sees the country you are in. This guide runs a two-minute DNS leak test and shows the fixes, including the single Surfshark VPN setting that closes the leak.
Table of Contents
What Is a DNS Leak?
A DNS leak happens when your device sends domain-name lookups to your internet provider instead of through the VPN tunnel. The Domain Name System is the web's phonebook, turning a name like a streaming site into the numeric address your browser needs. With a VPN on, those lookups should travel to the provider's own resolvers inside the tunnel. When one slips out, your ISP answers it and the sites you visit stay visible even while your IP looks hidden.
Why a DNS Leak Breaks Streaming and VPN Unblocking
Streaming platforms check far more than your IP address, and a leaked resolver can give away your real region even when the VPN is working. Netflix, Disney+, and BBC iPlayer compare the country your IP points to with the resolver that answers the request. If your IP says United States but your DNS answers come from your home provider, that mismatch looks like a proxy, and the player returns a regional error. A clean DNS path keeps every signal on the country you picked, so the region lock releases.
DNS Leak vs IP Leak vs WebRTC Leak: What Is the Difference?
Not every leak is a DNS leak, and each one exposes a different piece of your connection. A DNS leak reveals the sites you visit, an IP leak reveals your real address, and a WebRTC leak lets a browser call expose both. Most leak tests check all three, so read the labels first.
| Leak type | What it exposes | Where you notice it |
|---|---|---|
| DNS leak | The domain names you look up | Streaming shows your real region |
| IP leak | Your real public address | Sites and apps see your true location |
| WebRTC leak | Your local and public address | Browser calls and some players expose you |
How Do You Run a DNS Leak Test in Two Minutes?
You can test for a DNS leak in about two minutes with a free leak-test site and no extra software. Record a baseline before the VPN is on, then compare it with the servers that answer while it is connected.
Quick Steps: Run a Clean DNS Leak Test
- Disconnect your VPN, open a free leak test page such as dnsleaktest.com, and run the Standard test. Note the resolvers, because those belong to your provider.
- Reconnect Surfshark VPN and choose the server for the country whose catalog you want.
- Run the Extended test and let every round finish, since one round can miss a resolver that answers only sometimes.
- If the second list shows only your VPN resolvers, the tunnel is clean. If your ISP names remain, you have a confirmed leak.
What Do Your DNS Leak Test Results Mean?
Read the result by asking one question: did any non-VPN resolver answer a lookup? The table maps common outcomes to the fix that clears them.
| Result | What it means | What to do |
|---|---|---|
| Only your VPN provider's resolvers | Every lookup stayed in the tunnel | Nothing, the setup is clean |
| Your ISP's resolvers appear | Confirmed DNS leak | Turn on DNS leak protection |
| A mix of VPN and ISP servers | Partial leak | Reconnect, then switch server |
| An unexpected public resolver | Browser DNS-over-HTTPS is overriding the VPN | Disable DoH in the browser |
| IPv6 addresses you do not recognize | IPv6 traffic left the tunnel | Block or tunnel IPv6 |
How Do You Fix a DNS Leak?
Start with the VPN's own DNS leak protection, because it fixes the most common cause in seconds. If a leak remains, work through the four methods below in order and re-test after each change until only your VPN resolvers answer.
Method 1: Enable DNS Leak Protection in Surfshark VPN
- Open the Surfshark VPN app, then Settings and the VPN or Connectivity section.
- Turn on the DNS Leak Protection switch, sometimes labelled Prevent DNS leaks.
- Set any Custom DNS option back to default so Surfshark VPN manages resolution.
- Reconnect and run the Extended test to confirm the ISP resolvers are gone.
Method 2: Tunnel or Block IPv6
- If IPv6 addresses appear in your test, lookups are using the newer protocol while the tunnel wraps IPv4.
- On Windows, clear the Internet Protocol Version 6 checkbox in your adapter properties.
- On macOS, open Network, Details, TCP/IP, and set Configure IPv6 to Link-local only.
- Reconnect and re-test, or use the VPN's own Block IPv6 switch.
Method 3: Turn Off Browser DNS-over-HTTPS
- A public resolver you never chose means your browser is resolving names on its own.
- In Chrome or Edge, open the security settings and turn off Use secure DNS.
- In Firefox, open Privacy and Security and switch DNS over HTTPS off.
- Restart the browser, reconnect, and re-test so lookups follow the tunnel.
Method 4: Flush the DNS Cache and Switch Server
- A stale cache can keep answering from the old resolver, so clear it after a network change.
- On Windows run ipconfig /flushdns. On macOS run sudo dscacheutil -flushcache and sudo killall -HUP mDNSResponder.
- On Linux run sudo resolvectl flush-caches, then switch to another city or protocol.
- Re-test before you blame the VPN, because one server can behave differently.
Why Surfshark VPN Is the Simplest DNS Leak Fix
Surfshark VPN resolves names through its own encrypted DNS, so there is no lookup left to leak. Its current apps keep DNS leak protection on by default, add a kill switch that cuts the connection when the tunnel drops, and block IPv6 to close the second path. Connect to the country you want, run the test once, and the resolver and IP point at the same region. NordVPN is another tested option with private DNS and a kill switch, yet Surfshark VPN keeps it to a single toggle.
Routing your traffic through a VPN does not change the rules where you live. Check your local laws and the streaming service's Terms of Service before you open a blocked catalog, and remember that a VPN protects your privacy but does not make copyright infringement legal.
Frequently Asked Questions
What is a DNS leak test?
A DNS leak test is a free check showing which resolvers answered your lookups while the VPN was connected. Run it before and after you connect and compare the lists. If your provider's servers still appear, lookups are leaving the tunnel.
Does a DNS leak affect streaming access?
It can. Platforms cross-check the country your IP points to against the resolver answering your request. When the two disagree, the player falls back to your home catalog or throws a proxy error.
Is a DNS leak dangerous?
It is a privacy problem, not a virus. It lets your provider log the domains you visit even while your traffic is encrypted, which undoes much of the reason you turned the VPN on.
Why does my VPN still leak DNS?
The usual causes are a protection switch that is off, IPv6 traffic the tunnel does not carry, or a browser using its own DNS-over-HTTPS setting. Enabling protection and disabling DoH clears most leaks.
Do free VPNs leak DNS?
Free VPNs are far more likely to leak, because many do not run their own resolvers. A paid service such as Surfshark VPN includes private DNS and a kill switch.
In Short
A DNS leak is the quiet reason a working VPN can still fail on streaming, because lookups keep reaching your home provider and give your region away. Test it in two minutes by comparing resolvers with the VPN off and on, then fix the first leak by enabling DNS leak protection, blocking IPv6, and turning off browser DoH. Surfshark VPN closes all three paths from one settings screen, so the resolver and the IP match the country you chose.
Related posts:
What Is Smart DNS? How It Works in 2026 (And When to Use It)
What Is a VPN Tunnel? How It Works in 2026
How to watch DSTV outside South Africa (Top Method in 2026)
How Does a VPN Work? Ultimate Guide in 2026!
How to Watch Hulu in Singapore with a VPN Guide 2026
How to Watch Hotstar in Europe (Best Method in 2026)
How to watch Peacock TV in Canada (Top Method in 2026)
How to watch Hotstar in Australia? (Easy Guide in 2026)