In this article, we will answer the following questions: <\/p>\n\n\n\n
- What\u00a0is\u00a0a DNS and\u00a0how\u00a0does it work?\u00a0\u00a0<\/li>
- What is\u00a0a\u00a0DNS leak\u00a0and what causes it?\u00a0\u00a0\u00a0<\/li>
- How to perform a\u00a0DNS leak test\u00a0to tell if your DNS is leaking\u00a0<\/li>
- How\u00a0do you\u00a0prevent\u00a0a DNS leak?\u00a0<\/li>
- What risks are associated with a leaky DNS?\u00a0<\/li><\/ul>\n\n\n\n
What Is a DNS? <\/h2>\n\n\n\n
Since this article’s focus isn\u2019t about explaining what a domain name system (DNS) is (but it\u2019s still necessary to understand the topic), we\u2019ll keep this brief. If you already know the basics, feel free to skip this part. <\/p>\n\n\n\n
Everything that is connected to the internet (such as your\u00a0computer,\u00a0smartphone, and\u00a0organization\u2019s web\u00a0servers)\u00a0has\u00a0a digital identity\u00a0that\u2019s written\u00a0in\u00a0either a\u00a0numeric or\u00a0alphanumeric format.\u00a0This\u00a0is known as an internet protocol (IP) address.\u00a0IP addresses\u00a0come in different formats\u00a0\u2014 public, private, static, and dynamic\u00a0\u2014 and are\u00a0written in different ways based on their size.\u00a0\u00a0<\/p>\n\n\n\n
- A 32-bit IPv4 address<\/strong> is numeric and consists of four numeric segments that are separated by periods. So, an IPv4 address for google.com looks like this: 64.233.166.113. <\/li>
- A 128-bit IPv6 address<\/strong> is alphanumeric, which means it\u2019s much larger. This type of IP address consists of eight 16-bit hexadecimal blocks, all of which are separated by colons. An IPv6 address for google.com looks like this: 2607:f8b0:4002:c08::8a. <\/li><\/ul>\n\n\n\n
So, if you want to connect to a website, you need to provide that website\u2019s IP address to the web browser.\u00a0But as you can see, that\u2019s a lot of random numbers or letters to try to remember.\u00a0<\/p>\n\n\n\n
It’s\u00a0inconvenient and almost impossible for\u00a0the average\u00a0human brain to remember IP addresses for thousands of websites.\u00a0That’s\u00a0where the domain name system (DNS) technology comes in handy.\u00a0DNS\u00a0essentially\u00a0translates the website\u2019s\u00a0domain address\u00a0into the IP address\u00a0for you.\u00a0<\/strong>\u00a0<\/p>\n\n\n\n
The domain name system (sometimes called “domain name service”)\u00a0is a series of servers and computers that\u00a0connect\u00a0domain addresses\u00a0to their corresponding\u00a0IP\u00a0addresses\u00a0(either\u00a0IPv4 or IPv6).\u00a0They do this through a process known as a DNS lookup.\u00a0So, instead of typing in\u00a0a series of seemingly random numbers\u00a0every time you want to shop on Amazon, you can instead type in \u201camazon.com.\u201d\u00a0This simple approach\u00a0makes things a lot easier to remember.\u00a0\u00a0<\/p>\n\n\n\n
How Does DNS Work? <\/h2>\n\n\n\n
![\"what](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/10\/how-dns-works.png\")
This simplified illustration shows how the domain name system works in terms of handling DNS requests.<\/figcaption><\/figure>\n\n\n\n Basically, the domain name system serves as an intermediary between you and the website you are trying to open. <\/p>\n\n\n\n
- When you type a website\u2019s name, let\u2019s say Amazon.com, in your web browser, the browser needs to find that website\u2019s corresponding IP address to open it. So, it sends requests to DNS servers to track down the IP address. This request is sent via your internet service provider (ISP). <\/li><\/ol>\n\n\n\n
- The DNS server looks into its cache and responds to your browser with the website’s IP address from its DNS cache memory. If the DNS server can’t find it from the cache, it starts a four-step process that involves recursive resolvers, root nameservers, TLD nameservers, and authoritative nameservers. (Read more about these processes: DNS servers<\/a>) <\/li><\/ol>\n\n\n\n
- After all these processes, the DNS submits the corresponding IP address of the website you are searching for to the browser. The browser connects to the server where that IP address is (website) is hosted. Hence, the DNS works like a phonebook or a directory. You gave it the name of a website, and it searches for the website’s IP address. <\/li><\/ol>\n\n\n\n
What Is a DNS Leak? <\/h2>\n\n\n\n
![\"what](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/10\/how-does-dns-leak-work.png\")
This simplified illustration shows how what happens during a DNS leak.<\/figcaption><\/figure>\n\n\n\n Now that we know what a DNS is and how it works, it\u2019s time to answer the question, “what is a DNS leak?” In a nutshell, a DNS leak is a term that\u2019s used to describe data exposure despite the use of a virtual private network (VPN). Basically, your DNS server requests are visible to third parties. <\/p>\n\n\n\n
A VPN is a software that hides your original IP address and provides a new random IP address, which keeps changing frequently. It also creates an encrypted tunnel that securely transmits all the traffic between your browser, DNS, and the website’s server you are trying to connect! So, no one can track your online actions using your IP address. <\/p>\n\n\n\n
But sometimes VPNs fail to hide your IP address and encrypt the communication. When this happens, they reveal your original IP address (provided by your ISP) to anyone who can intercept the traffic between your browser and DNS, causing the DNS leaks. <\/p>\n\n\n\n
What Does a DNS Leak Mean in Terms of Privacy and Security?\u00a0\u00a0<\/h3>\n\n\n\n
So, a DNS leak means that someone can intercept the communications between your browser and DNS or steal the data from a DNS cache even though you\u2019re using a virtual private network (VPN). This is also known as an\u202fIP leak<\/a>. <\/p>\n\n\n\n
But what does steal this type of data accomplish? It means that intruders can: <\/p>\n\n\n\n
- Trace your device\u2019s IP address,\u00a0\u00a0<\/li>
- See what types of sites you visit (based\u00a0on your browser\u2019s DNS requests),\u00a0and<\/li>
- Monitor all your online\u00a0activities.\u00a0\u00a0<\/li><\/ul>\n\n\n\n
But wait, don\u2019t your ISP\u2019s DNS servers already keep records of your DNS requests? Yes, if you\u2019re using your ISP\u2019s DNS servers by default instead of the VPN\u2019s DNS servers. That\u2019s because browsers need the internet to communicate, and your ISP (and its DNS servers) to make that happen by default if the VPN isn\u2019t configured to use its own servers. That means your internet provider \u2014 and anyone else who can legally (or illegally) access their servers \u2014 can monitor all your actions online by tracing your IP address from the browser-IPS DNS communications. <\/p>\n\n\n\n
What Causes a DNS Leak? <\/h3>\n\n\n\n
There are different reasons for why you can experience a DNS leak. A few potential causes of DNS leaks include: <\/p>\n\n\n\n
- Your network\u2019s DNS settings are incorrect or improperly configured. <\/li>
- Your ISP may be using transparent DNS proxies. <\/li>
- There are issues in your IPv4 to IPv6 transition process. <\/li><\/ul>\n\n\n\n
Needless to say, a DNS leak is no laughing matter. But how do you know if the DNS server you\u2019re using is leaking? <\/p>\n\n\n\n
How to Conduct a DNS Leak Test <\/h2>\n\n\n\n
As we mentioned before, by default, all the traffic between your browser and the DNS server is unencrypted.\u00a0(This means that\u00a0it\u2019s\u00a0sent in plaintext format, so anyone can read it.)\u00a0Your ISP and any\u00a0hacker can easily track all your online actions when they intercept this communication. <\/p>\n\n\n\n
But if\u00a0you\u2019re\u00a0using a VPN and\u00a0worry that you have a DNS leak, you should follow these steps.\u00a0<\/p>\n\n\n\n
- Turn off your VPN.\u00a0<\/li>
- Open one of these websites:\u202fdnsleaktest.com<\/a>\u202for\u202fdnsleak.com<\/a>.\u00a0<\/li>
- Note\u00a0down the resulting information the page displays. This is going to be your ISP IP address, ISP\u2019s name,\u00a0hostname,\u00a0and geographical location.\u00a0<\/li>
- Now, turn on the VPN and select any other geographical location of your choice.\u00a0<\/li>
- Once again, go to the DNS leak checking website and conduct the test. This time, you should see the different IP addresses, internet provider’s names, and geographical locations. If you still see your original ISP IP address and other details, your VPN is suffering from a DNS leak.\u00a0<\/li><\/ol>\n\n\n\n
Check out the screenshot below of my DNS leak test \u2014 the first one I took without turning on the VPN, which shows my original IP address. Then, I turned on VPN and chose Mumbai as my geographic information. As you can see, all the details changed when I conducted the DNS test. It indicates that my VPN is not suffering from a DNS leak. <\/p>\n\n\n\n
![\"Graphic](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/10\/image.png\")
<\/figure>\n\n\n\nIf your DNS leak test shows your DNS isn\u2019t leaking, that\u2019s great news. However, just know that it means that you\u2019re not experiencing a DNS leak now<\/em> \u2014 but that doesn\u2019t mean you won\u2019t experience one in the future. So, you may want to periodically re-test to ensure your DNS doesn\u2019t have a leak. <\/p>\n\n\n\n
But what if you discover that your DNS server is<\/em> experiencing a DNS leak? What can you do to stop or prevent future DNS leaks? <\/p>\n\n\n\n
How to Prevent DNS Leaks <\/h2>\n\n\n\n
As we know, DNS traffic and records tend to be insecure and unencrypted by default. This means that if you\u2019re using your ISP\u2019s DNS servers, you can’t prevent your ISP from tracking your actions or selling that data to advertisers (we\u2019ll speak more to the dangers of DNS leaks shortly) except by taking the legal route. But these are some steps you can take to prevent DNS leaks from occurring. <\/p>\n\n\n\n
Let’s break down the steps for how to prevent a DNS leak. <\/p>\n\n\n\n
1. Use a\u00a0Robust VPN\u00a0\u00a0<\/h3>\n\n\n\n
Using a secure and reliable VPN is the best way to hide your original IP address and encrypt the tunnel between your browser and DNS servers. But, sometimes, the browsers bypass the VPN\u2019s IP address and access your original IP address to send the DNS requests. This causes DNS leaks. Hence, use the following tips while using a VPN: <\/p>\n\n\n\n
- Enable DNS leak prevention feature<\/strong>. While purchasing a VPN, you should always check whether it has a DNS leak prevention feature. <\/li>
- Use VPN monitoring <\/strong>software<\/strong>. VPN monitoring software keeps an eye on critical metrics\u202fto\u202fensure the integrity of the VPN connection. They make sure that all the DNS requests pass through a VPN tunnel and can’t access the user’s original IP address. <\/li><\/ul>\n\n\n\n
It can immediately block the requests or alert the users if someone is trying to bypass the VPN IP address. <\/p>\n\n\n\n
\u00a02. Clear DNS\u00a0Caches\u00a0\u00a0<\/h3>\n\n\n\n
The DNS cache stores information of all your browsing history. If an intruder <\/strong>intercepts it, they can track all your online actions. So, keep flushing the DNS cache on a regular basis. <\/p>\n\n\n\n
Here are a few quick steps you can take to<\/strong> delete <\/strong>your <\/strong>DNS cache <\/strong>on<\/strong> <\/strong>W<\/strong>indows<\/strong>:<\/strong> <\/p>\n\n\n\n
- Click on the Start<\/strong> menu, search for cmd<\/em><\/strong>. <\/em><\/strong>Open the <\/em><\/strong>command prompt. <\/li><\/ul>\n\n\n\n
- Enter ipconfig\/<\/em>flushdns<\/em> <\/em>in the prompt. <\/li><\/ul>\n\n\n\n
3.\u00a0Disable Microsoft Teredo\u00a0<\/strong>\u00a0<\/h3>\n\n\n\n
Microsoft Teredo is the technology that smooths the transition from IPv4 to IPv6 in Windows-based devices. Until all hosts are on IPv6, Teredo helps to give full IPv6 connectivity to the hosts that are on the\u202fIPv4\u202fInternet<\/a>. <\/p>\n\n\n\n
While this is a great feature in many cases, it\u2019s not perfect. Sometimes, it bypasses the VPN’s IP address and accesses the ISP\u2019s IP address, causing DNS leaks. However, you can manually turn-off teredo by following these three steps: <\/p>\n\n\n\n
- Click on the Start<\/strong> menu and search for cmd<\/em><\/strong>. <\/em><\/strong> <\/li><\/ol>\n\n\n\n
- When you see the command prompt<\/strong> apear, right-click on the icon and select Run as an administrator<\/strong>. <\/li><\/ol>\n\n\n\n
- Type in the following command:\u00a0netsh\u00a0interface teredo set state disabled.<\/em><\/strong>\u00a0<\/li><\/ol>\n\n\n\n
Whenever you want to\u00a0resume using\u00a0Teredo again, type\u00a0netsh\u00a0interface teredo set state type=default\u00a0<\/em><\/strong>into the command prompt\u00a0to enable it.\u00a0\u00a0<\/p>\n\n\n\n
4. Change\u00a0Your Settings to Default to Use\u00a0Your VPN\u2019s\u00a0DNS\u00a0Servers\u00a0\u00a0<\/h3>\n\n\n\n
If you don\u2019t use the default IPS DNS server, your ISP won\u2019t be able to track your actions. You can use the VPN\u2019s DNS server instead. Or if you decide to go the public DNS server route, only choose the DNS server provider that you completely trust. Check out this resource: How to use Google’s DNS server<\/a>. <\/p>\n\n\n\n
5. Use Secure DNS Service\u00a0<\/h3>\n\n\n\n
There are some solutions, like Comodo’s Secure Internet Gateway<\/a>, that provide a secured DNS connection on an enterprise level. It encrypts all the DNS traffic to prevent leaks. Apart from preventing DNS leaks, this tool also provides a DNS filtering service. It monitors all the DNS requests and blocks malicious websites. You can also manually change the settings and block the non-work-related websites to improve employees’ productivity. <\/p>\n\n\n\n
Why Is a DNS Leak Dangerous? <\/h2>\n\n\n\n
For many people, it may not seem like that big of a deal. But for people who have concerns about their privacy or live in regions of the world where certain internet-related activities are prohibited, a DNS leak can be a big deal. DNS records can be used for anything from censorship to tracking or limiting internet use or even legal punishments. So, if you\u2019re using a VPN to try to access content that\u2019s prohibited or banned by your government, DNS records could be used against you. <\/p>\n\n\n\n
For people who don\u2019t have those same types of concerns, there are other privacy-related issues that can stem from DNS leaks. For example, your ISP can sell your browsing data to marketers and advertisers. They closely monitor all the webpages you visit, understand your interest areas and buying behaviors, and show the advertisements accordingly to manipulate your purchase habits. <\/p>\n\n\n\n
And there\u2019s also the cybercrime angle of concern. For example, if a hacker intercepts your data from DNS leaks, they can target you via sophisticated email phishing attacks<\/a> that are based on this information. And if they know you or any of your coworkers frequently visit specific sites (such as a vendor\u2019s website), they could create watering hole phishing websites to target you all as well. <\/p>\n\n\n\n
That\u2019s a scary thought, am I right? Let’s take a few moments to understand how hackers use your browsing history for phishing attacks with a hypothetical example. <\/p>\n\n\n\n
Your DNS Request Data Could Be Used as Phishing Email Fodder <\/h3>\n\n\n\n
Let\u2019s say an intruder uses your leaky DNS to their advantage and intercepts your DNS request data. They notice that you visit Chase bank\u2019s website a lot. Although they can\u2019t see your credentials and any confidential details due to the bank’s TLS\/SSL certificates, but they notice that you frequently visit Chase bank’s website and web pages relating to student loans. <\/p>\n\n\n\n
Bingo! The hacker knows that you\u2019re at least interested in finding more about loans or are maybe even considering applying for one. So, the attacker sends you a sophisticated phishing email<\/a> using Chase bank’s logo and writing style that\u2019s designed to appear to be part of the bank\u2019s loan approval process. In the email, they ask you for your social security number, bank account number, and other confidential details! <\/p>\n\n\n\n
You, having been on the site and applied for the loan, might not think twice about such a request. This is why it\u2019s not uncommon for people to fall for such traps. <\/p>\n\n\n\n
Your Data Could Be Used for Malvertisement-Based Cyber Attacks <\/h3>\n\n\n\n
Malvertising<\/a> means malware-laden advertisements, which attackers use to distribute viruses, trojan horses<\/a>, worms, etc. onto victims\u2019 devices. Data from DNS leak can be used to target people who visit specific websites via malvertising attacks. <\/p>\n\n\n\n
Let\u2019s consider another example. Say, a hacker intercepts your DNS cache and notices that your frequently visiting websites that provide tips to accelerate mobile phone\u2019s speed. The hacker could create an advertisement on that website to lure you in: \u201cIs your phone getting slow? It might be infected with a virus. Scan your phone now with this free antivirus software to detect and remove the viruses!\u201d <\/p>\n\n\n\n
If you click on that malvertisement, it could automatically download malware onto your device. <\/p>\n\n\n\n
DNS Data Is a Great Social Engineering Resource for Cybercriminals <\/h3>\n\n\n\n
In social engineering<\/a> attacks, the scam artists use social media and other tools to gather information about you to plot a cyber attack<\/a>. With DNS leak, the hacker can track the pages, groups, and profiles you visited on social media and learn about your interests and the type of people you interact with. Then they use this info to: <\/p>\n\n\n\n
- Guess your login credentials. <\/li>
- Make fake profiles\/ groups to interact with you and persuade you to share your personal info. <\/li>
- Send you malware-loaded files or attachments in the inbox. <\/li>
- Send you links that take you to spammy or malicious sites. <\/li><\/ul>\n\n\n\n
In the same way, advertisers can also track your social media activities and show the advertisements accordingly. In short, your browsing behavior is way more valuable to advertisers and hackers than you imagine! <\/p>\n\n\n\n
Final Words on DNS Leaks & How to Prevent Them <\/h2>\n\n\n\n
Just like any other technology, DNS has its weak points. A DNS leak makes it easy for intruders (both hackers and advertisers) to gain valuable information about you from the web pages you visit. They can know a wide variety of information, including your: <\/p>\n\n\n\n
- Bank,\u00a0\u00a0<\/li>
- School,\u00a0\u00a0<\/li>
- Workplace,\u00a0\u00a0<\/li>
- Favorite ecommerce<\/a> sites,\u00a0\u00a0<\/li>
- Insurance company,\u00a0\u00a0<\/li>
- Likes,\u00a0dislikes, and areas of interest,\u00a0\u00a0<\/li>
- Concerns you are facing\u00a0(or may be seeking solutions for), and\u00a0<\/li>
- People you communicate with on social media.\u00a0\u00a0<\/li><\/ul>\n\n\n\n
- Type in the following command:\u00a0netsh\u00a0interface teredo set state disabled.<\/em><\/strong>\u00a0<\/li><\/ol>\n\n\n\n
- When you see the command prompt<\/strong> apear, right-click on the icon and select Run as an administrator<\/strong>. <\/li><\/ol>\n\n\n\n
- Click on the Start<\/strong> menu and search for cmd<\/em><\/strong>. <\/em><\/strong> <\/li><\/ol>\n\n\n\n
- Enter ipconfig\/<\/em>flushdns<\/em> <\/em>in the prompt. <\/li><\/ul>\n\n\n\n
- Use VPN monitoring <\/strong>software<\/strong>. VPN monitoring software keeps an eye on critical metrics\u202fto\u202fensure the integrity of the VPN connection. They make sure that all the DNS requests pass through a VPN tunnel and can’t access the user’s original IP address. <\/li><\/ul>\n\n\n\n
- After all these processes, the DNS submits the corresponding IP address of the website you are searching for to the browser. The browser connects to the server where that IP address is (website) is hosted. Hence, the DNS works like a phonebook or a directory. You gave it the name of a website, and it searches for the website’s IP address. <\/li><\/ol>\n\n\n\n
- The DNS server looks into its cache and responds to your browser with the website’s IP address from its DNS cache memory. If the DNS server can’t find it from the cache, it starts a four-step process that involves recursive resolvers, root nameservers, TLD nameservers, and authoritative nameservers. (Read more about these processes: DNS servers<\/a>) <\/li><\/ol>\n\n\n\n
- A 128-bit IPv6 address<\/strong> is alphanumeric, which means it\u2019s much larger. This type of IP address consists of eight 16-bit hexadecimal blocks, all of which are separated by colons. An IPv6 address for google.com looks like this: 2607:f8b0:4002:c08::8a. <\/li><\/ul>\n\n\n\n
- A 32-bit IPv4 address<\/strong> is numeric and consists of four numeric segments that are separated by periods. So, an IPv4 address for google.com looks like this: 64.233.166.113. <\/li>