0

I use Windows 10, and I've configured my network to use Quad9 in Windows settings. I've also enabled DoH.

Now, when I go to ExpressVPN DNS Leak Test webpage to know whether I have DNS leaks or not, it indicates that

DNS requests exposed!

How do I prevent my DNS being exposed (leaked)?

For some reasons, I cannot use VPNs.

Note(s)

  • I use Brave browser, I have tried to run the test with secure custom DNS (set to Quad9) in the Brave settings, but still leaks.
1
  • There are two current proposals for "oblivious DNS" that could help you. Also you may want not to read too much in that report. When you set up DoH in a browser, only the browser uses it (and indeed then there is no leak, even if not using a VPN your DNS queries - from the browser - are encrypted between you and the DoH server you chose), but all OS requests for name resolution are NOT using DoH, hence probably the report. Other options depending on your needs: install a running resolver on your own computer OR on a remote controlled one and use only it. Aug 23, 2021 at 17:12

1 Answer 1

2

Short answer: You can't, because it's a meaningless concept outside the use of a VPN.

There seems to be a fundamental misunderstanding on what a DNS leak is. A DNS leak happens whenever your connection is otherwise tunneled through a VPN, but for some reason a DNS request is sent outside of your tunnel, revealing your original IP instead of of the VPN's IP. That's what the data leaked in a "DNS leak" is: Your original IP and the DNS request you made.

Since you are not using a VPN to begin with, all of your activity, including DNS requests, include your original IP, and that's by design, as the responses could not find your computer without its IP. That's why the test is reporting a fail, because it's testing for whether your VPN correctly tunnels your DNS requests. Since you are not using a VPN, the result is obvious: Your DNS requests aren't being tunneled, as none of your traffic is tunneled.

2
  • "You can't, because it's a meaningless concept outside the use of a VPN." and "Since you are not using a VPN to begin with, all of your activity, including DNS requests, include your original IP," more or less true, depending on from whom you want to "hide" your IP address: the next hop or the final (recursive) DNS server? In the later case, have a look at blog.cloudflare.com/oblivious-dns Aug 23, 2021 at 17:13
  • 1
    Arguably DNS-over-HTTPS is another context in which this question would become meaningful.
    – gowenfawr
    Aug 23, 2021 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.