Definition
A DNS leak occurs when DNS queries — the lookups that translate domain names into IP addresses — are sent outside the VPN tunnel. The user appears to be connected to the VPN, the IP address looks correct, but every site they visit is being announced to their ISP through the back door. DNS leaks are one of the most common practical failures of consumer VPNs and historically a problem on Windows, where the operating system can prefer the ISP-provided resolver over the VPN-provided one.
Common Causes
Causes include: the VPN client not pushing its DNS settings to the operating system; the OS using IPv6 DNS even though the VPN tunnel only handles IPv4; Windows' Smart Multi-Homed Name Resolution sending parallel queries to all available resolvers; certain browsers using their own DoH that bypasses system settings. Each of these can be fixed but requires specific countermeasures.
Detection and Prevention
Sites like dnsleaktest.com, ipleak.net, and browserleaks.com run a battery of DNS lookups and report which resolvers answered. If any non-VPN resolver appears, you have a leak. Reputable VPN clients now include a built-in DNS leak protection feature that forces all DNS through the tunnel, blocks IPv6 unless properly tunnelled, and overrides browser-level DNS. A robust kill switch helps as well by dropping traffic entirely if the tunnel fails.