---
title: "VPN DNS leak on Mac: check which DNS server you use · Kilobat Guides"
url: "https://kilobat.app/guides/vpn-dns-leak-mac"
description: "Check if a Mac sends DNS queries to the VPN's DNS servers or to the local network. Find the settings that send DNS outside the tunnel."
---

DNS

# DNS queries go outside the VPN on a Mac

With a VPN on, you usually want DNS queries to go to the VPN's servers. Some settings send them to the local network's servers instead.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

## Symptoms

- The VPN is connected, but a DNS test shows the local provider's servers.
- Sites see your local network's DNS server while the VPN is on.
- Internal names work, but other names use the local network's DNS.

## Likely causes

- **Manual DNS servers on Wi-Fi or Ethernet.** Servers that you typed in for a network service can stay in use beside the VPN's servers.
- **A split-tunnel VPN.** Some VPNs send only some domains or networks through the tunnel. Other queries use the local servers.
- **An encrypted DNS profile or a DNS app.** A DNS Settings profile or another DNS app can send queries to its own server.
- **The VPN app's settings.** Many VPN apps have their own DNS options. These options decide which servers macOS gets.

## How to check

1. Connect the VPN. Show the DNS configuration. Resolver #1 is the default for most names.

   ```
   scutil --dns
   ```

   Output Each resolver with its `nameserver` addresses, its `if_index` interface and, for some, a `domain`.
2. Find the interface of resolver #1. A VPN interface often has a name such as `utun`.

   ```
   ifconfig -l
   ```
3. Look for DNS servers that you set by hand on the physical service.

   ```
   networksetup -getdnsservers Wi-Fi
   ```
4. Look for profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
5. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.

## How to fix it

1. Remove DNS servers that you set by hand on Wi-Fi or Ethernet, if you do not need them.

   ```
   networksetup -setdnsservers Wi-Fi empty
   ```

   Needs an administrator password.
2. Open the VPN app's settings. Turn on its option to use the VPN's DNS, if it has one.
3. Remove a DNS profile that you do not need. Select it in Device Management or Profiles, then click the Remove button.
4. Disconnect and connect the VPN again. Run `scutil --dns` again and compare.
5. Ask the VPN provider or your administrator which DNS servers the tunnel should use.

## With Kilobat

1. Kilobat lists the VPN interfaces beside the physical ones.

   ```
   kilobat interfaces --json
   ```
2. For a private name, `why` says which VPN resolver it went to and if it answers. It also compares the direct path with the tunnel.

   ```
   kilobat why intranet.corp.example
   ```

## Questions

**Does a VPN always handle all DNS?**

No. The VPN decides. A split-tunnel VPN can send only some domains to its DNS servers.

**Why do I see more than one resolver?**

macOS can use many resolvers. Resolvers with a `domain` line answer only for that domain. The scutil man page explains this.

## Sources

- scutil(8), man page installed with macOS 27.2
- resolver(5), man page installed with macOS 27.2
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- [Apple Support: Change the order of the network services your Mac uses](https://support.apple.com/guide/mac-help/change-order-network-services-mac-mchlp2711/mac)
- [Apple Support: Use configuration profiles to standardize settings on Mac computers](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names): macOS can send queries for one domain to one DNS server and other queries to another.
- [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac): Normal DNS queries are not encrypted.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.