Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
A ‘DNS leak’ is a security flaw that reveals Domain Name System (DNS) requests to an Internet Service Provider’s (ISP) servers, despite the user’s effort to conceal them through a Virtual Private Network (VPN) service.
This means that a user’s browsing activity, including their IP address, location, and web searches, is routed through the ISP as if they were not using a VPN. With the user’s private online data exposed, threat actors can track their activity and eavesdrop on their DNS traffic, potentially redirecting them to a malicious website.
In this article, we will have a closer look at what causes a DNS leak, what are its implications, how to spot the signs of leaking DNS traffic, and how to fix and prevent it from endangering the security of your endpoint and your network.
How Does a DNS Leak Occur?
To begin with, domain names are translated into IP addresses with the help of the Domain Name System (DNS). For instance, when you type heimdalsecurity.com into your browser, it first contacts a DNS server and requests the unique IP address of the site.
If your DNS settings are set to the defaults, the ISP or anyone else who has legal or illegal access to the DNS Server can see what you do online. But if you are using a Virtual Private Network (VPN), your DNS queries are pushed through a VPN tunnel and sent through the DNS servers operated by the VPN service, making it impossible for your ISP to track your online activities.
However, even if you use a VPN you are still not 100% safe because even VPN servers could leak DNS requests – this is considered a DNS leak. For various reasons such as incorrect configuration, or if your VPN service lacks its own DNS servers, once your internet traffic leaks outside of the secure VPN tunnel, your private online data gets out.
What Causes a DNS Leak?
As we’ve already established, when you connect to a VPN, all your internet traffic is routed through an encrypted tunnel to the VPN server. This means that your ISP (internet service provider) can no longer see which websites you are visiting or what data you are transferring.
However, in the case of a DNS leak, your DNS requests are not being routed through the VPN tunnel—which means that your ISP can see which websites you are trying to access. But what exactly causes it?
5 Reasons for DNS Leaks
Well, a DNS leak can happen for several reasons, including if the VPN server is not configured correctly, if your device is not using the correct DNS server, or if there is a problem with the VPN tunnel itself. Here’s a list of 5 possible reasons why you might encounter a DNS traffic leak:
- A misconfigured VPN. One of the most common causes of DNS leaks is a VPN that has been set up incorrectly and is using the user’s ISP’s DNS server. Users who frequently switch between different networks are more likely to experience this issue because VPNs necessitate a connection to the ISP before logging in.
- A lack of IPv6 support. The vast majority of VPN services only support IPv4, making them incapable of processing requests made from or received by IPv6 devices. These VPNs were unable to process the request because it came from a machine using a dual-stack tunnel, that converts IPv4 into IPv6. Because some VPNs do not yet support IPv6, the user’s DNS query will be sent outside the secure tunnel as the internet makes its way through this protocol transition.
- Teredo Feature. To address the IPv6/IPv4 gap, Microsoft has introduced Teredo Technology. But since it is a tunneling protocol, it can also bypass a VPN’s encrypted tunnel and cause DNS Leak.
- Transparent DNS Proxies. When ISPs discover that their customers have changed their DNS Server settings to a server other than their own, they can use transparent DNS proxies to force customers back to using their own DNS servers. Users’ web sessions will be terminated by this transparent server and redirected to the DNS server maintained by the user’s Internet service provider.
- Windows Smart Multi-Homed Name Resolution (SMHNR). This smart feature has been added to Windows 8 and later. SMHNR tends to send the request to all of the available DNS servers, but the first one to respond is used. Because this is most likely your ISP’s DNS server, you might get a DNS leak.
Why Are DNS Leaks Dangerous?
When your DNS leaks, your computer is essentially broadcasting which websites you’re trying to visit. This can be a major privacy concern, as it can give away which sites you’re visiting, even if you’re using a VPN.
A DNS leak can also cause computer performance issues. It can make your internet connection slower, as your computer will be constantly sending out DNS requests. Additionally, it can make it difficult to access certain websites, as your computer may be trying to connect to the wrong DNS server.
A leaking DNS might enable a potential attacker to see which websites you are visiting and can use that information to redirect you to malicious websites. The ‘leaked’ information might be used together with other data to perform phishing attacks, employ malware, or plot ransomware attacks. They can even use it for social engineering attacks or malvertising, as DNS leak data can be used to learn a lot about a user’s interests based solely on the websites he interacts with.
How to Prevent a DNS Leak?
The good news is that DNS leaks can be avoided if you follow a few simple steps:
- Use a reputable, trustworthy VPN service that encrypts all traffic and routes it through a private server, making it less likely to leak DNS requests.
- Configure your VPN to use the DNS servers provided by your VPN service.
- Disable IPv6 on your computer or router if it’s not needed. As I explained above, the transition to IPv6 can sometimes cause DNS leaks.
- You can consider using a Firefox or Chrome extension such as DNSCrypt to encrypt and secure your DNS requests.
- Use completely anonymous web browsers like Tor Browser, which not only hides the user’s identity but also does not require any DNS configuration on the operating system.
- Run occasional tests with online tools like dnsleaktest.com to check for leaks and make sure your precautions are working as intended.
How Can Heimdal® Help?
Even if you are experiencing DNS leaks, using a trustworthy VPN service is still a great option to protect your privacy. For security, however, you will need a threat prevention product. To successfully protect yourself against malicious attacks targeting your DNS traffic, a DNS traffic filtering solution is your best bet.
This is where we come to the rescue – with Heimdal® Threat Prevention, a product designed to protect both endpoints and networks by detecting and preventing future threats using AI and machine learning. It inspects and terminates potentially harmful URLs and processes in DNS, HTTP, and HTTPS traffic.
Our software stops man-in-the-middle attacks, discovers zero-day exploits, fights data leakage, and prevents security breaches or network infections by screening all network packages based on the origin and destination of DNS requests and preventing malicious packages from trying to connect over the network.
Threat Prevention – Endpoint also enables you to perform category-based web page blocking, ensuring that your private information is secure regardless of where you or your employees (if you’re an organization) choose to work from. It works in tandem with any existing antivirus product to block malicious domains as well as communications to and from C2 centers and other malicious servers.
Heimdal® DNS Security Solution
Wrapping Up
A DNS leak can be a serious issue, as it can allow third parties to intercept and eavesdrop on your traffic. If you’re concerned that you might have a DNS leak, you can first run a DNS leak test to check. But keep in mind that even with a VPN service on, you are not one hundred percent safe so adding multiple layers of proactive protection to your system would be the best choice to ensure you and your organization’s cyber defense.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
Madalina, a seasoned digital content creator at Heimdal®, blends her passion for cybersecurity with an 8-year background in PR & CSR consultancy. Skilled in making complex cyber topics accessible, she bridges the gap between cyber experts and the wider audience with finesse.
