Does a VPN protect against a malicious DNS configuration on the Access Point?

By my understanding it should, since traffic to the final destination should be encrypted and encapsulated inside packets then sent to the VPN server. The AP with the corrupted DNS cache might either let the traffic pass because the destination is not interesting, or reroute it, but in this case it should still cause no harm because it is encrypted and only the VPN server can handle it.

I've tried to google this but found no answers and I can't set up a test right now.

2 Answers 2


This depends entirely on how the VPN is configured. Some VPNs will push their configuration (including DHCP options and the routing table) to your computer, changing your default routes to send all traffic, including DNS, over the VPN. If this is done, then your access point will not be queried for domain resolution and a malicious or compromised access point will be bypassed. To tell if this is actually done, you will need to supply more information, such as your current routing tables and the VPN client configuration file. If you are configuring your own VPN, see the above-linked how-to for instructions on pushing the server configuration (including DNS) to the client.

  • Thank you for your answer, I haven't considered the case in which the AP is not queried for DNS resolution and yes, in this case there's no problem. But still, even if I query my AP to resolve the DNS the stream towards the VPN should be encrypted (assuming it is) and the AP can't redirect me towards a malicious website because it doesn't know which server i'm connecting to and even with a correct guess my traffic has to pass through the VPN and be decrypted there. I'm just asking out of curiosity ^^
    – Fiochkij
    Commented Aug 6, 2018 at 0:25

I would say the answer is yes for a properly designed VPN service. This is one of the main reasons to go for a VPN. Additionally now-a-days most good VPN services would also suspend the internet connection on the device (kill switch they call it) if the VPN is not connected - that is the VPN client on the device is not connected to the VPN server of the provider - implying is the VPN tunnel is broken.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .