Culvert VPNWhat a DNS leak is
A DNS leak is when your phone's name lookups go to the local network's resolver instead of through the VPN, exposing every site you visit. The fix.
A DNS leak is what happens when your phone sends its name lookups, the translation of a name like example.com into an address, to the local network's resolver instead of through the VPN tunnel. The traffic to the site itself still goes through the tunnel, so the site sees the VPN's address, but the Wi-Fi owner, the carrier or the ISP sees a complete list of every site you visited and when. It is the most common way a working VPN still gives away your browsing, and it is entirely avoidable.
What DNS is doing in the first place
Every time an app connects to a name, the phone first asks a resolver for that name's address. Without a VPN the resolver is whatever the network handed out when you joined it: the router at a café, the carrier's resolver on mobile data. That resolver sees every name you look up. It is also, in plain DNS, an unencrypted query that anyone on the path can read. The post on where DNS queries go covers what the resolver can learn.
A VPN is supposed to change this. When the tunnel comes up, the app should tell the phone to use a resolver inside the tunnel, usually one the VPN provider runs, so queries travel encrypted to the VPN server and are answered there. The local network then sees only the encrypted tunnel, and the names inside it are as private as the traffic.
How a leak happens
| Cause | What goes wrong |
|---|---|
| The app sets no DNS server on the tunnel | The phone keeps using the network's resolver, outside the tunnel, for every lookup |
| The DNS server it sets is reachable outside the tunnel | Queries may be routed directly rather than through the VPN |
| The tunnel carries IPv4 only | IPv6 lookups to the network's IPv6 resolver go around the tunnel, the same failure as an IPv6 leak |
| An app excluded by split tunnelling | Its lookups are outside the tunnel by design, which is correct but easy to forget |
| Android Private DNS points elsewhere | Lookups go to the configured public resolver, not the VPN's |
| The tunnel drops briefly | The phone falls back to the network resolver until the VPN restores its own |
The first row is the classic leak and the one most people mean. The others are subtler, and the Private DNS post covers the Android-specific interaction in detail.
What a leak reveals, and what it does not
DNS carries names, not contents. A leaking resolver learns that you looked up a bank's site, a news site and a messaging service, and the times you did. It does not see which pages, what you typed, or what came back, because that travels through the tunnel and, on nearly every site, inside HTTPS as well.
That still matters. The list of names you visit over a day is a detailed picture of your life, and the local network gets it for free. On public Wi-Fi it is the exact information a VPN is being used to keep private. On a home connection it is what the ISP would otherwise record.
How a good VPN prevents it
Three things have to be true at once, and the app has to arrange all of them.
- The tunnel sets a DNS server. On Android the VPN app declares DNS servers when it builds the tunnel interface, and the system then routes every ordinary lookup to them. If the app declares none, nothing changes.
- That server is reachable only through the tunnel. Its address should be inside the VPN's own address range, so a query cannot take any path but the tunnel. A public resolver address, even a good one, can be routed directly.
- The resolver at the far end is trustworthy. Fixing the leak moves your queries from the network's resolver to the VPN provider's. That is only an improvement if the provider's resolver does not keep them.
The third point is where a provider's own practice matters. Culvert VPN's servers run their own resolver with query logging compiled out, so there is no query log to keep; more broadly, Culvert does not log the sites you visit, your DNS queries or the contents of your traffic, its servers see only an opaque connection id rather than an account, and it keeps the client IP address for up to 30 days for abuse handling, as set out in its privacy policy.
How to check for one
Turn the VPN on, then run a DNS leak test and look at which resolver addresses answered. Every one should belong to the VPN provider or sit inside its address range. If you see your carrier's or your ISP's resolvers, or the address of the Wi-Fi router, your lookups are going around the tunnel. The Android DNS leak test post walks through it step by step, including how Private DNS and excluded apps can confuse the result.
One caution: a leak test is itself a set of lookups that reveal you are testing, and the site running it sees your queries. Run it when you need to confirm a setup, not habitually.
Culvert VPN sets a resolver inside the tunnel's own address range on every connection and answers queries on its servers with logging compiled out, so lookups never reach the local network's resolver; it is on Google Play.
Questions people also ask
Does a DNS leak expose what I do on a site?
No. DNS reveals the names of the sites you visit and when, not the pages or contents. With HTTPS the contents stay private either way; the leak is about the list of names.
Can Android's Private DNS setting cause a leak?
It can interact badly with a VPN. If Private DNS points at a public resolver by name, lookups may go to that resolver rather than the VPN's, which is not a leak to the local network but is a query to a third party.
How do I test for one?
With the VPN on, use a DNS leak test and look at which resolvers answered. They should belong to the VPN provider, not your carrier or the Wi-Fi network's ISP.