DNS Leak

A DNS leak happens when the lookups that turn a domain name into an IP address escape your encrypted tunnel and go to your ISP's resolver instead. Even if the rest of your traffic is tunnelled, those lookups reveal the domains you are visiting — a serious privacy hole, because your ISP (or anyone watching that resolver) can log every site. Leaks arise when an app or the operating system is configured to use a fixed DNS server outside the tunnel, or when the tunnel does not capture DNS at all.

For a VPN, check DNS routing and resolver settings in both the OS and browser. A leak test observes its own queries, not every application or failure state. WebRTC and IPv6 need separate checks. DNS over HTTPS or DNS over TLS encrypts the path to a resolver; it does not by itself put that path inside the VPN or hide queries from the resolver.

Practically, connect your VPN and then run a leak test, checking that the resolver shown belongs to the tunnel and not your ISP. Reconfigure any app or system setting that pins DNS to a fixed external server outside the tunnel. Treat it as part of a wider audit alongside the WebRTC and IPv6 checks, since each closes a different channel. A correctly configured s4m VPN routes DNS through the tunnel so lookups exit with the rest of your traffic.