AnonymFlow
securite-reseauHOWTO

How to Fix a DNS Leak on Windows 11 (2026): The Setting That Causes Most of Them

Most DNS leaks on Windows are not caused by your VPN. They come from Smart Multi-Homed Name Resolution, which queries every adapter at once. Here is how to confirm the leak and switch it off.

By Eric Gerard · Editor · AnonymFlow4 min readPhoto via Pexels

If your VPN is connected and a leak test still shows your internet provider, the instinct is to blame the VPN. On Windows that is usually the wrong suspect.

Windows has a feature called Smart Multi-Homed Name Resolution. When it is enabled, Windows does not send a DNS query through one interface and wait. It sends the same query out of every interface at once - your VPN tunnel and your physical network card - and uses whichever reply comes back first. Your ISP's resolver is therefore asked directly, in parallel, no matter how correctly the tunnel is set up.

That is why switching VPN provider rarely fixes this, and why the leak can appear on a connection that is otherwise flawless.

Step 1 - Confirm the leak before changing anything

Do not skip this. Half of the "leaks" people try to fix are misread test results.

With the VPN connected, run a DNS leak test and look past the pass/fail badge at which organisation owns each resolver that answered:

  • Every resolver belongs to your VPN provider → no leak.
  • Any resolver belongs to your ISP (Orange, Comcast, Deutsche Telekom, Free…) → that query left the tunnel.

One caveat worth knowing: browser-based testers only observe queries the browser makes. Leaks produced by Windows services or background applications never touch the browser and can pass a web test while still happening. Our DNS leak test reports the owner of each resolver rather than a single verdict, which is what lets you tell these cases apart.

A black TP-Link TL-SG1005P five-port gigabit desktop switch on a wooden surface, with a white-and-yellow cable in port 1 and a red cable on the right, green link LEDs lit.
A black TP-Link TL-SG1005P five-port gigabit desktop switch on a wooden surface, with a white-and-yellow cable in port 1 and a red cable on the right, green link LEDs lit.
The switch in the photo has five ports and Windows will happily ask through all of them at once. That is the whole problem: more paths mean more chances for a query to take the wrong one.

Step 2 - Turn off Smart Multi-Homed Name Resolution

This is the fix for the majority of Windows DNS leaks. It is a single policy setting and it is reversible.

Windows 11 Pro, Enterprise and Education - via the Group Policy Editor:

  1. Press Win + R, type gpedit.msc, press Enter.
  2. Go to Computer Configuration → Administrative Templates → Network → DNS Client.
  3. Open Turn off smart multi-homed name resolution.
  4. Set it to Enabled - the wording is confusing, but "Enabled" here means the feature is turned off.
  5. Apply, then reboot or run ipconfig /flushdns.

Windows 11 Home does not include the policy editor, so use the registry:

  1. Press Win + R, type regedit, press Enter.
  2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient.
  3. Create the key if it does not exist.
  4. Create a DWORD (32-bit) named DisableSmartNameResolution and set it to 1.
  5. Reboot.

Back it up first if you are not comfortable in the registry - export the key before you change it.

Step 3 - Deal with IPv6, the second cause

If your VPN carries only IPv4 while your connection has native IPv6, requests can travel over IPv6 completely outside the tunnel. Two honest options:

  • Use a VPN that routes IPv6 properly. This is the correct fix, not a workaround.
  • Disable IPv6 on the adapter while connected: Settings → Network & Internet → your adapter → Edit → uncheck IPv6. Blunt, effective, and worth undoing afterwards if you need IPv6.

Step 4 - Test again, on the same machine

A fix you have not verified is a belief, not a fix. Reconnect the VPN, flush the cache with ipconfig /flushdns, and run the test again. Every resolver should now belong to your VPN provider.

If your ISP still appears after all of the above, the remaining suspects are, in order: a VPN client that does not force its own resolvers, a third-party firewall applying its own DNS rules, or DNS-over-HTTPS enabled in your browser pointing somewhere outside the tunnel - Chrome and Firefox both have this setting, and it bypasses the system resolver entirely.

What not to bother with

Setting 1.1.1.1 or 8.8.8.8 on the physical adapter does not stop a leak. The query still leaves the tunnel; it just reaches Cloudflare or Google instead of your ISP. That is a change of recipient, not a fix - and if your reason for using a VPN is that your ISP should not see your queries, handing them to a different third party is not obviously better.

Reinstalling the VPN client is the second most common wasted afternoon. The behaviour described here belongs to Windows, not to your VPN.

The short version

Confirm the leak by looking at who owns the resolvers, not at a badge. Turn off Smart Multi-Homed Name Resolution. Handle IPv6. Test again on the same machine. In our experience that sequence resolves the large majority of Windows 11 DNS leaks, and none of it requires changing provider.

Editorial pick
4.6 / 5

Secure your connection with NordVPN

Threat Protection blocks trackers & malware · kill switch · 30-day money-back

Deloitte audit 202430-day guarantee14M+ users
See the offer
Everything you need to know.

Frequently asked questions

Why does Windows leak DNS even when my VPN is connected?

Because of a Windows feature called Smart Multi-Homed Name Resolution. When it is active, Windows sends the same DNS query out of every network interface at once - your VPN tunnel and your physical adapter - and simply uses whichever answer arrives first. Your VPN is working correctly; Windows is asking your ISP's resolver in parallel behind its back. This is why a leak can appear on a tunnel that is otherwise perfectly configured, and why changing VPN provider usually does not fix it.

How do I know if I actually have a DNS leak?

Run a test while the VPN is connected and look at which organisations own the resolvers that answer. If every resolver belongs to your VPN provider's network, you are fine. If any of them belongs to your internet provider - Orange, Comcast, Deutsche Telekom and so on - that query left the tunnel. Browser-based testers catch the obvious cases but only see queries triggered by the browser itself, so leaks coming from Windows services can slip past them.

Does disabling Smart Multi-Homed Name Resolution break anything?

On a normal home or office machine, no. The feature exists to speed up name resolution when a device is connected to several networks at once, and to help with split-horizon DNS on some corporate setups. If you are on a company laptop that resolves internal hostnames through a domain controller, check with your IT team first, because that is the one case where it does real work.

Is IPv6 also a source of leaks?

Yes, and it is the second most common one. If your VPN only carries IPv4 and your connection has native IPv6, requests can travel over IPv6 outside the tunnel entirely. Either use a VPN that routes IPv6 properly, or disable IPv6 on the adapter while you are connected. Test again afterwards - assuming it is fixed is how leaks survive.

Do I need to change my DNS servers manually?

Usually not. A well-configured VPN pushes its own resolvers when it connects, and forcing a public resolver like 1.1.1.1 on the physical adapter does not stop a leak - it only changes who receives the leaked query. Fix the cause first, then set resolvers manually only if you have a reason to.

Related articles

Read next