I have recently started using a VPN. I visited
dnsleaktest.com and was informed by both of these sites that my DNS was leaking. Indeed, I could see in the list of servers, that a couple were associated with my ISP.
- The owners of the servers above have the ability to associate your personal IP address with the names of all the sites you connect to and store this data indefinitely. This does not mean that they do log or store it indefinitely but they may and you need to trust whatever their policy says.
- If you are connected to a VPN service and ANY of the servers listed above are not provided by the VPN service then you have a DNS leak and are choosing to trust the owners of the above servers with your private data.
I contacted the VPN provider about this issue. I was told they do not currently provide their own standalone DNS addresses. I was provided with addresses to use instead. These are OpenDNS addresses. I then asked them to confirm whether using these OpenDNS addresses would ensure a secure and encrypted connection and use of DNS.
The VPN provider replied:
- Using these third party DNS addresses over the VPN connection, still encrypts your requests, by sending them to the VPN server, where they are then passed to the DNS resolving service, thus making your connection secure.
Using the provided DNS addresses, only OpenDNS related addresses come up when testing on the two afformentioned sites.
My question is: Are they correct in telling me that my DNS queries are being encrypted by the VPN service(assuming the VPN does indeed work!), and are therefore secure and private?
Something about this claim didn't feel quite right.. Another couple of questions that occur to me regarding this:
- Can a DNS service, unrelated to the VPN provider really deal with an encrypted DNS request?
- Does the DNS request really go through the VPN BEFORE the DNS service?