Private DNS vs VPN: what each one protects

Private DNS and a VPN can both improve privacy, but they protect different parts of your connection. Private DNS protects the requests your device makes to look up website names. A VPN routes your internet traffic through a VPN server and can hide your home IP address from the sites you visit.

That does not mean a VPN always hides your real IP. A browser may expose it through IPv6 or WebRTC, a feature used by some calling apps. Use the VPN Leak Test to check for those leaks, then use the fixes below if your real IP appears.

Check what your VPN exposes

1. Connect to your VPN using its app or your device's VPN settings. Wait for the app to confirm the connection before testing.
2. Open the VPN Leak Test in the browser you normally use. Keep the VPN connected while the test runs.
3. Review the result for possible IPv6 or WebRTC leaks. These are ways your real network address could be exposed even when the VPN appears connected.
4. If the result suggests a leak, disconnect the VPN and run the test again. Comparing the two runs can help you identify your normal connection address and tell whether the VPN changed what the browser reports.
5. Reconnect the VPN and repeat the test after trying a fix. If possible, check again in another browser you use regularly.

This tool checks for IP exposure through IPv6 and WebRTC. It does not test whether your DNS requests are encrypted or routed through the VPN.

What the result means

The VPN address appears and no leak is reported

The test did not find your real IP through the routes it checks at that moment. That is a useful sign, but it is not proof that every app, website, or type of traffic is protected. The result can change if you switch VPN servers, disconnect the VPN, change network settings, or use a different browser.

Your normal IP appears while the VPN is connected

The VPN may not be routing all traffic, or the browser may be exposing your real address through IPv6 or WebRTC. Private DNS will not fix this: it changes how website names are looked up, not the public IP address used to connect to sites.

You are unsure whether DNS is protected

This test cannot answer that question. DNS, short for Domain Name System, translates a name such as example.com into an address computers can connect to. Private DNS usually means that DNS requests use an encrypted connection to a DNS provider. The provider can still see the requests it receives, and private DNS does not encrypt all the other traffic from your device.

A VPN can send DNS requests through its tunnel, but that depends on the VPN app and its settings. Some devices or browsers can use a separate encrypted DNS service. That may protect the request from people on a local network, but it does not automatically make the request part of the VPN tunnel.

How to fix an exposed IP

1. Confirm the VPN is connected. Open the VPN app and check that it shows an active connection, not just a selected server. Disconnect and reconnect, then run the test again.
2. Turn on leak protection in the VPN app. Look for settings with names such as IPv6 leak protection, DNS leak protection, or WebRTC protection. The exact options depend on your VPN provider. Do not assume that a private DNS setting provides these protections.
3. Check the device's VPN connection. On Windows 11, open Settings › Network & internet › VPN and check the connection. On macOS, open System Settings › VPN. If VPN does not appear in the sidebar, check System Settings › Network. A connection listed there does not by itself confirm that every app's traffic is routed through it.
4. Review IPv6 handling. Some VPNs route IPv4 traffic but do not handle IPv6 the same way. Check the VPN app for an IPv6 option or ask its support whether IPv6 traffic is protected. Avoid turning IPv6 off across your whole device as a first step, because that can disrupt other connections.
5. Check the browser's WebRTC behavior. WebRTC supports live audio and video in the browser. Browser privacy controls or extensions may limit how it shares network information, but changing them can affect calls. Change one setting at a time, then retest and confirm that your meeting apps still work.
6. Check private DNS separately. On Android, look under Settings › Network & internet › Private DNS. Menu names vary by device. On Windows 11, check Settings › Network & internet › Wi-Fi › DNS server assignment for the connected network. On macOS, check System Settings › Network › Wi-Fi › Details › DNS. The available options depend on the system version and provider. Setting a DNS server address alone does not necessarily encrypt DNS requests.
7. Retest on another network. If the issue continues, try a different VPN server and network, such as a phone hotspot. If the leak only occurs on one network or device, that comparison can help narrow down where the problem is.

On iPhone and iPad, there is not a universal system-wide switch called Private DNS. Encrypted DNS is typically configured through a profile or an app. Whatever device you use, check the VPN app's own instructions before changing network settings.

Why private DNS is not the same as a VPN

Think of private DNS as protecting one kind of request: asking which address belongs to a website name. A VPN creates a tunnel between your device and a VPN server for the traffic it routes through that tunnel. Websites then usually see the VPN server's public IP address instead of your home IP address.

Neither setting makes you anonymous. A website can still recognize an account you sign into, and the VPN provider can see some connection information. HTTPS protects the contents of a connection between your browser and a website, whether or not you use a VPN. For IP protection, keep the VPN connected and use the leak test after changing VPN or browser settings.