What is a DNS leak, and how do you stop one?

Every time you open a website, your device first asks a DNS server to translate the name — jaguarvpn.com — into an IP address it can connect to. That lookup happens before any page loads, for every site you visit. Whoever answers those lookups gets a complete, timestamped list of every domain you go to.

Normally that “whoever” is your internet provider. A VPN is supposed to change that: with the tunnel up, DNS queries should travel encrypted to the VPN’s own resolvers. A DNS leak is when they don’t — your traffic goes through the VPN, but your lookups still slip out to your ISP. The websites you visit stay readable to exactly the party you were trying to shut out.

Why leaks happen

The most common causes are mundane. Your operating system may keep using a manually-configured DNS server that bypasses the tunnel. Some routers intercept DNS traffic and answer it themselves. Windows in particular has a habit of sending queries out of every network interface at once (“smart multi-homed name resolution”), racing your VPN’s resolver against your ISP’s.

Browsers add their own wrinkle: features like secure DNS (DNS-over-HTTPS) send lookups to a third party such as Google or Cloudflare. That’s not a leak to your ISP, but it is another company logging your browsing history.

How to test for a leak

Testing takes half a minute: connect your VPN, then run our free Privacy Check. It shows which DNS servers are actually answering your lookups, alongside your visible IP, WebRTC status and browser fingerprint. If the DNS servers shown belong to your ISP rather than your VPN, you have a leak.

Test again whenever your setup changes — a new router, a fresh OS install, or a new browser privacy setting can all silently reintroduce one.

How JaguarVPN prevents leaks

JaguarVPN runs its own no-logs DNS resolvers inside the encrypted tunnel and forces every query through them while you’re connected — the apps override system and router DNS settings so there is nothing to misconfigure. Combined with the kill switch, which blocks all traffic if the tunnel ever drops, your lookups never fall back to your ISP.

If you want the full picture of what your connection reveals, the Privacy Check is free and runs in any browser — no app or account needed.