Where your DNS queries go, with and without a VPN

Without a VPN, every DNS query your phone makes goes in plain text to the resolver the network handed it when you joined, which is usually run by the ISP or the Wi-Fi owner, and that resolver sees the name of every site you are about to visit. With a VPN connected properly, the tunnel gives your phone a different resolver, one run by the VPN provider, and the queries travel encrypted inside the tunnel to it. What that resolver then does with the queries is the part to check, and a VPN whose DNS still goes to the local network has a leak.

What a DNS query is

Before your phone can load a site it needs the site's IP address, so it sends the name to a resolver and gets the address back. That happens for every site, every image host, every ad server and every app backend, often several times per page. The query is small and, by default, unencrypted, so whoever runs the resolver and anyone on the path to it sees a stream of names with timestamps that is, in effect, your browsing history by site.

The resolver is not something you chose. When your phone joins a network it is told which resolver to use, and it uses that one.

Without a VPN

On home Wi-Fi the resolver is typically your ISP's, so your ISP sees every name. On café or hotel Wi-Fi it is whatever the router was configured with: the venue's ISP, a public resolver, or a filtering service the owner chose. On mobile data it is the carrier's. In every case the party running the network sees the names, and so can anyone else on the path, because the queries are plain text.

Android offers a way to encrypt this without a VPN: Private DNS, under Settings > Network & internet, which sends queries over TLS to a resolver you name. It hides the names from the local network, but the resolver you pick now sees them all instead, and it does nothing for the rest of your traffic. The VPN vs Private DNS post compares the two properly.

With a VPN, done right

When the tunnel comes up, the VPN pushes a resolver address to your phone alongside the routes, and Android sends DNS queries to that address through the tunnel. The local network sees encrypted packets to the VPN server and no DNS at all. The provider's resolver answers the query, and the answer comes back the same way.

Three things have to be true for this to work:

1. The VPN provides its own resolver inside the tunnel, rather than letting your phone keep using the network's.
2. Android actually uses it for all queries, including from apps that make their own DNS requests.
3. IPv6 queries are handled too, or a network with IPv6 lets some lookups slip out the side.

With a VPN, done wrong: the leak

A DNS leak is what happens when the tunnel is up but some or all of your queries still reach the network's resolver. The sites load normally, the app says connected, and the Wi-Fi owner or ISP is still seeing every name. Causes include a VPN that does not push a resolver, an IPv6 path the VPN did not claim, or Android's Private DNS being set to a hostname that resolves outside the tunnel. The DNS leak explainer goes through each, and the Android leak test shows how to check your own phone in a minute.

Private DNS and a VPN interact in a way worth knowing: with Private DNS set to a specific hostname, Android may keep using that resolver over TLS through the tunnel, which is private from the network but means the VPN's own resolver is not the one answering. The Private DNS and VPN post covers which setting wins.

What the VPN's resolver can see

Once your queries go to the provider's resolver, that resolver sees exactly what the ISP's used to: every name, with a timestamp, tied to the session that asked. This is the single most revealing thing a VPN provider handles, more so than the encrypted traffic passing through, because the names are already in plain text by the time they reach it.

So the question about any VPN's DNS is whether the resolver logs. Common resolver software logs queries by default, and a provider that has not deliberately turned that off is keeping a browsing history without meaning to. A policy that describes the resolver and states that query logging is off is the answer to look for, because a DNS log is a usage log, the kind that records what you did rather than merely that you connected.

Culvert VPN runs its own resolver on each VPN server, built with query logging compiled out, so there is no query log to keep; it does not log the websites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id, and it keeps your client IP address for up to 30 days for abuse handling, as set out in its privacy policy.

Where the names go, in one table

For DNS that stays inside the tunnel and reaches a resolver that cannot write a query log, Culvert VPN is on Google Play.