Every time you load a website, your device asks a DNS resolver to turn the domain name into an IP address. Type blackoutvpn.au, and a resolver answers with the numeric address your connection actually uses. That question and answer is DNS resolution, and it happens before any page loads. If those requests go to your internet provider's resolver instead of through your VPN tunnel, your provider sees a timestamped list of every domain you visit. The page contents stay encrypted. The list of where you went does not.
This is a DNS leak, and it is one of the most common ways a VPN quietly fails to protect you. Your ISP, your network operator, or anyone watching the resolver logs gets a clean record of your browsing while you assume the VPN has you covered, because the DNS lookups slip around the tunnel that encrypts everything else.
Leaks happen because DNS is handled by parts of the system that do not always respect the tunnel. Your operating system keeps its own DNS settings, usually pointed at your ISP by default. If the VPN does not override those settings, the OS keeps asking your provider directly. Windows makes this worse with a feature that sends DNS queries out every available network interface at once and uses whichever answers first, which routinely bypasses the tunnel. Browsers add their own layer. Chrome and Firefox can run DNS-over-HTTPS to a resolver you never chose, sending lookups straight past the VPN. IPv6 is another escape hatch. If your VPN only routes IPv4 and your network hands out IPv6 addresses, those requests leak. Then there is split-horizon behaviour, where a device is configured to use a local resolver for some names and a public one for others, and the split sends part of your traffic outside the tunnel.
Testing takes about two minutes and costs nothing. Turn your VPN on, then visit dnsleaktest.com and run the extended test, or use browserleaks.com/dns. The result shows which DNS servers answered your queries. If the servers and their locations match your VPN provider, DNS is going through the tunnel. If you see your ISP's name, your real country when you expected the VPN's, or a resolver you did not configure, you have a leak. Run the test again on any new network, because a setup that is clean at home can leak on public Wi-Fi or a phone hotspot.
Fixing it depends on where the leak comes from. The cleanest fix is to force DNS through the tunnel at the VPN config level. A WireGuard config, which is what Blackout uses, sets the resolver with a DNS line in the interface section, so every lookup goes to the VPN's resolver over the encrypted link for as long as the tunnel is up. If your provider's app does not do this, or you built the tunnel by hand, add or check that DNS line in the config. Beyond that, disable secure DNS or DNS-over-HTTPS in your browser so Chrome and Firefox stop routing lookups on their own. Disable IPv6 at the OS level if your VPN does not tunnel it, or use a provider that handles IPv6 inside the tunnel. On Windows, turn off smart multi-homed name resolution so the system stops broadcasting queries across every interface. After any change, run the leak test again and confirm only the VPN's resolvers answer.
A VPN's whole job is to keep what you do off the record. DNS is the one channel most likely to break that promise without any visible sign, because the pages still load and the connection still works while your provider quietly logs the domains. Test for it, close the gap at the config level, and check again whenever you switch networks.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What is a DNS leak
A DNS leak happens when your device sends domain name lookups to your ISP's resolver instead of through the VPN tunnel. Your provider then sees every site you visit even though your traffic is encrypted.
How do I test for a DNS leak
Turn your VPN on and visit dnsleaktest.com or browserleaks.com/dns. If the resolvers that answer belong to your VPN provider you are fine, and if you see your ISP or a server you did not choose you have a leak.
Why does DNS leak even with a VPN running
The operating system, the browser, or an IPv6 connection can send DNS queries outside the tunnel if the VPN does not override them. Windows multi-homed name resolution and browser DNS-over-HTTPS are common causes.
How does WireGuard prevent DNS leaks
A WireGuard config sets the resolver with a DNS line in the interface section, which forces all lookups through the VPN's resolver over the encrypted link while the tunnel is active.
Do I need to retest on every network
Yes. A setup that passes at home can leak on public Wi-Fi, a hotspot, or a network that hands out IPv6, so retest whenever you connect somewhere new.