DNS leaks explained: why VPN DNS matters
Author
EVPN Research
Date
July 26, 2026
Reading Time
7 min read
If DNS leaves the tunnel, destination intent often leaves with it.
A VPN can encrypt application traffic and still leak metadata if name resolution takes a different path. DNS leaks are one of the most common — and most misunderstood — failure modes.
What a DNS query reveals
A DNS lookup typically discloses:
- That a device is trying to reach a named service
- Timing patterns around browsing or app usage
- Enough signal for a local observer or resolver operator to infer activity
Even without packet payloads, DNS is a rich behavioural channel.
How leaks happen
Common paths:
- The OS continues using a local or ISP resolver alongside the VPN
- IPv6 DNS or routing is not covered while IPv4 is
- Applications bypass system DNS
- Split configurations send some names outside the tunnel unintentionally
“VPN connected” in a UI does not guarantee DNS confinement.
What private in-tunnel DNS is designed to do
EVPN’s private DNS design aims to:
- Keep DNS requests inside the encrypted tunnel
- Prefer EVPN-controlled recursive resolvers over a public resolver by default
- Pair with Leak Shield so DNS does not silently escape when protection is enabled
- Operate with a no query-logging policy on those resolvers
That is a design commitment. Independent audit evidence will be published when available — not invented ahead of time.
What private DNS does not solve
Private DNS does not:
- Hide destinations from the VPN operator’s data plane if that operator chooses to observe (architecture and policy must constrain this)
- Stop account logins from identifying you to websites
- Replace HTTPS
- Defeat every form of traffic analysis
It closes a specific leak class. It is not a complete privacy stack.
Practical checklist
When evaluating any VPN DNS story, ask:
- Are DNS queries forced into the tunnel?
- What happens on reconnect or drop?
- Is IPv6 included?
- Is query logging disabled by policy and design?
- Can the user inspect resolver behaviour?
DNS is not a footnote. For private networking, it is part of the product.
