DNS traffic leak outside VPN tunnel on Android

Recently we were made aware of a potential DNS traffic leak outside the VPN tunnel on Android. Even with Android OS “Always-on VPN” and “Block connections without VPN” options enabled, as per the report the plaintext DNS traffic can be observed outside the VPN tunnel.

During our investigation, we were able to confirm the issue when using different VPN apps on Android (including the IVPN app). The issue was reproduced in several different Android versions, including the latest Android 14.

A DNS leak can occur when an app (e.g. Chrome app) calls the getaddrinfo function to resolve domains. Note that getaddrinfo function can leak DNS even when the option “Block connections without VPN” is enabled. The issue should be fixed in a future Android version.

Steps to reproduce

1. Enable “Block connections without VPN” in Android Settings -> VPN -> [provider] -> Settings
2. Start tcpdump and filter DNS traffic
3. Connect or reconnect VPN
4. Open or refresh a web page in the Browser
5. Check tcpdump for plaintext DNS traffic

Recommendations

DNS leaks can seriously impact user privacy, resulting in potential exposure of browsing history and geolocation, or tracking and profiling. Depending on your threat model, consider avoiding using Android in situations where DNS leaks can impact your privacy, until the issue is fixed in a future Android OS version.

Featured posts

Related posts

IVPN News

Unlinked Access security audit concluded

Posted on November 9, 2026 by Viktor Vecsei Juraj Hilje

We’re pleased to announce that our eighth annual independent security audit has concluded. The assessment focused on Unlinked Access, the system that lets IVPN Plus and Pro Suite accounts access Mailx, modDNS and Portmaster without passing IVPN account identifiers to those services.

IVPN News

A security incident on our Bitcoin payment server

Posted on August 11, 2026 by IVPN Staff

Summary: on 7 August a critical vulnerability was disclosed in BTCPay Server, the open-source software we self-host to accept Bitcoin payments. It was being exploited before disclosure, and we were among the merchants hit: an attacker extracted our Lightning node credentials and transferred out our operating funds.