Fix DNS Leaks

Stop DNS queries from bypassing your VPN tunnel and exposing browsing metadata to your ISP.

A DNS leak sends domain lookups to your ISP or a third-party resolver instead of the VPN’s DNS servers. Websites may still see encrypted HTTPS traffic through the tunnel, but your ISP logs which domains you looked up.

Detect a leak

With VPN connected, open rookvpn.com/check/vpn-leak-test/dns. Pass: only VPN-provided resolvers appear. Fail: your ISP hostname or a non-VPN public DNS (e.g. 8.8.8.8 configured locally) appears.

Client-side fixes

• Enable Use VPN DNS or Block outside DNS in your VPN/Hiddify settings.
• Disable custom DNS in Windows, macOS, or router settings while testing.
• On Linux, inspect systemd-resolved and NetworkManager — they may override VPN DNS with local stub resolvers.

DNS over HTTPS (DoH)

DoH encrypts queries but does not automatically route them through the VPN. If the browser uses DoH to Cloudflare or Google while the VPN assigns different DNS, you may still leak metadata. Align DoH provider with VPN policy or disable DoH during VPN use.

Related

• VPN leak testing guide
• Check IP via curl