Short answer: Windows DNS leaks usually come from a resolver path mismatch: the VPN is connected, but the browser or operating system still uses ISP DNS, router DNS, browser Secure DNS, an old adapter setting, or a split tunnel rule.
DNS can reveal domain-level lookups even when the page IP appears to use a VPN. A Windows-focused check helps you separate VPN DNS, browser DNS, adapter DNS, router DNS, and IPv6 behavior.
Problem
- Four layers can each choose the resolver on Windows: the browser, the VPN app, the adapter, and the router.
- The one that answers first wins, which is why a correct adapter setting can look like it did nothing.
- This reads the resolver reached from this browser, not the resolver every Windows application uses.
Run the test
Start with DNS Leak Test. Keep the same browser and network when comparing before and after.
- Run DNS Leak Test with the VPN disconnected and note resolver owner and country.
- Connect the VPN and run the same DNS Leak Test again in the same browser.
- If results differ by browser, check Secure DNS or DNS-over-HTTPS settings.
- If results still point to ISP/router DNS, review VPN DNS leak protection and Windows adapter DNS settings.
- Run VPN Leak Test, WebRTC Leak Test, and IPv6 Leak Test if the DNS result does not match the visible IP route.
- Use Safe Copy after the final run so you keep safe categories without raw resolver IPs.
How to read the Windows DNS Leak Test result
| Result | Usually means | What to do next |
|---|---|---|
| VPN provider DNS | Usually expected when the VPN manages DNS. | Check DNS, IP, WebRTC, and IPv6 together before assuming all is clean. |
| Public DNS you selected | Can be normal if browser or system Secure DNS is intentional. | Document that this is your chosen resolver path. |
| ISP or home router DNS | Stronger review signal while VPN is connected. | Check VPN DNS protection, adapter settings, and split tunneling. |
| Different country only | Not automatically a leak because anycast and geolocation can differ. | Focus on resolver owner and intent, not country alone. |
| Inconclusive endpoint | The browser could not get a usable signal. | Retest after reconnecting or use another browser/network for comparison. |
Windows places to review
- VPN app DNS leak protection and kill switch settings.
- Windows Network and Internet adapter DNS configuration.
- Browser Secure DNS settings in Chrome, Edge, Firefox, or Brave.
- Split tunneling rules that exclude the browser.
- Router DNS and IPv6 behavior when the router controls the route.
What to do after the result
On Windows the resolver you see is chosen by whichever layer answers first, so change them in that order rather than all at once: the browser's own Secure DNS, then the VPN app's DNS leak protection, then the adapter's DNS entries under Network and Internet, then the router. Each layer can override the one beneath it, which is why an adapter change appears to do nothing while Chrome or Edge is still resolving through its own DNS-over-HTTPS provider.
Judge the outcome by resolver owner, not by the country label. A VPN provider's resolver answering from the wrong country is usually anycast and needs no action, while your own ISP's resolver answering with the tunnel up is the result that does, whatever country it claims. If the owner is still your ISP after all four layers are set, retest on a different network before blaming the VPN: a captive portal or a router that forces its own DNS produces exactly the same reading.
Frequently asked questions
Is DNS country mismatch always a Windows DNS leak?
No. Anycast, resolver routing, and geolocation databases can make the country label differ. Resolver owner and intent matter more.
Can browser Secure DNS bypass VPN DNS on Windows?
Yes. If the browser uses its own Secure DNS provider, the DNS result can differ from VPN DNS.
Should I flush DNS cache before every test?
Usually no. Reconnect the VPN and retest first. Flush or restart only when stale behavior appears.
Limits and methodology
MyIPScan checks show observable browser and network signals for the current session. Results can change with browser profile, app route, VPN server, router, OS, carrier, DNS, and time. See the methodology and editorial policy.