What DNS Does on a VPN (Plain English)

Start with the boring object. A stub resolver on your device has a question: what address is this name. It sends that question to a recursive resolver. That resolver may already know, or it may walk the DNS tree until an authoritative server answers. You do not need the four-server diagram memorized to use a VPN. You need to know which recursive resolver you are talking to, because that machine sees the names.

Off the VPN, that recursive resolver is often the ISP. Sometimes it is the router, which then forwards to the ISP. Sometimes it is a public resolver you configured because a video said your ISP is slow. On the VPN, if the client is doing the job Klox documents, the recursive resolver is the VPN's. The query is inside the tunnel. The ISP does not get the shopping list.

A leak test exists because the UI can say connected while the stub still asks the old resolver. The test is a later article. Here: if the hop did not change, you bought a tunnel for web packets and left the table of contents in the clear. That is the failure mode. It is common enough that every serious VPN has to talk about DNS at all.

I will not walk you through a test page in this post. If you want steps, open DNS Leak: Why It Matters and How to Test and the Leak Test After You Connect a VPN checklist. Come back here if you only wanted the English for what changed.

Without a tunnel, your laptop is a customer of the access network. DHCP typically pushes DNS servers. Home: often the router, which forwards to the ISP. Phone hotspot: the carrier. Cafe: whoever runs that gateway. Each query is a name you intended to visit, plus timing, plus your real address as the asker.

That log is useful to the operator, and sometimes to advertisers. You can argue about retention laws in your country. You cannot argue that the query did not happen. It went to their resolver unless you changed it.

Changing it to a famous public resolver without a VPN is a different bargain. You stop handing names to the ISP's recursive server. You start handing them to the public operator, and the ISP may still see that you are talking to 1.1.1.1 or 8.8.8.8. Encrypted DNS can hide the name from the ISP and still show the public resolver everything. That is not a VPN. That is a new landlord for the phone book.

Klox is not that landlord while you are disconnected. Off means off. Tunnel DNS applies when the tunnel is up. After you disconnect, the Mac should go back to what the network handed you. Leftover resolvers are how people file tickets that say the internet is broken after they quit the app.

Connect. The client should install routes and DNS settings for the session. Names should now go through the tunnel to the VPN resolver. Web packets should go through the tunnel to the exit. Your ISP sees encrypted traffic to the VPN. The site you visit sees the VPN exit address, not your home address.

Those are two changes. People mash them. IP change without DNS change is a leak-shaped failure: the site thinks you are at the exit, the ISP still got the name. The after-connect post is the checklist. This post is the hop.

Klox documents all DNS through the VPN tunnel. Leave that default. This article is not a custom-DNS manual. If the live app has advanced fields, confirm them there. Do not copy a farm's 1.1.1.1 into an adapter because a chart said it was faster. I will not invent a speed test. The point of Klox DNS is the hop, not a millisecond contest.

Five devices means five stubs. Connecting the Mac does not change DNS on the phone. People file that as a leak. It is geography of devices. Turn the app on where you care.

ISP DNS: the access network's recursive resolver, or the router that feeds it. It knows you as a subscriber. It sees names in the clear unless you encrypted DNS to someone else. It is convenient. It is also the log people buy a VPN to stop feeding.

VPN DNS: a resolver you reach through the tunnel. The ISP does not get the name list. The VPN operator does, in the sense that their resolver answers you. Whether they keep that, for how long, is a privacy-policy question, not a protocol question. I will not invent a retention number. Read the live policy. I will not invent an audit badge so the resolver feels enterprise.

Public DNS without a VPN is a third column. Fine products for what they are. They are not Klox tunnel DNS. A competitor farm titled best DNS servers is usually teaching that third column. Specimen, not a shopping list. We route names through the tunnel. That is the product sentence.

Encrypted DNS to a public resolver while a VPN is up can bypass the VPN resolver. The browser talks DoH to 1.1.1.1. That traffic might still go through the tunnel as IP packets, so the ISP is not reading the names, but the public resolver is, and you are no longer using Klox DNS. Some people want that. Say so on purpose. Do not do it by accident because Chrome enabled a secure DNS row.

The toggle is a client state. The resolver is a network fact. Those can disagree. A leak test asks: now that you claim to be connected, who answers names? If the answer looks like the ISP you had at baseline, the hop did not change. That is why the test exists. It is QA, not a character reference.

I am not going to list click paths or how to read every result. That would clone the leak posts. Run a test when you care, while connected, after a baseline with the VPN off, and treat a pass as this device, this network, this moment. Then come back to the hop.

Why would the hop fail? Client did not override system DNS. You stacked DoH in the browser. You excluded the browser in split tunnel. A content filter grabbed names. IPv6 DNS left the building, which is the other article. A work profile pinned a resolver. You never allowed the VPN configuration on Sequoia, so you were never in the tunnel and you tested anyway.

Klox's features list is the intent: DNS through the tunnel. A test is how you check intent against reality. Intent without a test is marketing. A test without understanding the hop is a screenshot you cannot interpret. Keep both. Do not merge the posts.

The features page says all DNS through the VPN tunnel. Automatic on all servers. While connected, names should not go to the ISP resolver as the recursive hop. They should go inside the encrypted tunnel.

It also lists IPv6 leak protection and WebRTC leak blocking. Those are sibling protections, not DNS. WebRTC is the browser volunteering addresses. IPv6 is the other internet. DNS through the tunnel does not, by itself, stop a STUN script. WebRTC blocking does not hide the names you looked up. Read the labels.

I am not documenting a consumer custom-DNS picker. If the live app shows a field, confirm it there. Leave the default: tunnel DNS. If a farm says set Cloudflare DNS inside the VPN for privacy, they are mixing the third column with the second. Cloudflare's DNS explainer is a good textbook. It is not a reason to override Klox while connected.

Yearly from $2.83 a month, seven-day money-back, five devices, WireGuard, OpenVPN, OpenConnect, and Shadowsocks. None of those numbers change the hop. If tunnel DNS is why you bought, verify with the leak post inside the window. If you wanted a best-DNS ranking, that is a different product.

Chrome, Firefox, Edge, Safari: various rows named secure DNS or DNS over HTTPS. They send names to a resolver the browser vendor or you chose, inside HTTPS. That can be good on a naked cafe. It can fight a VPN.

While Klox is connected, I want apps to use tunnel DNS. A browser that insists on DoH to a third party is a second policy. Those packets might still ride the tunnel, so the ISP is not reading them. You have still moved the name log to the DoH operator, and you have stopped using Klox's resolver. If that is a conscious choice, fine. If it is a default you never noticed, turn the browser row off while you use the VPN.

This is not anti-Cloudflare. Their DNS explainer is in the first section on purpose. It is anti-stacking without noticing. One hop you understand beats three hops you collected.

Extensions that force DNS, privacy browsers with their own resolvers: same class of problem. Isolate. Test with a boring browser profile. Do not run four name policies and then ask which one leaked.

Split tunnel means some apps skip the VPN on purpose. Their packets go direct. Their DNS often goes back to the system resolver, which is the ISP again. That is expected for excluded apps. It is a leak only if you thought exclude meant hide the names too. It usually does not.

If you exclude the browser, then run a DNS leak test in that browser, you will fail a VPN that is doing what you asked. Include the browser, or accept that the test is for the included path.

OS features that query multiple resolvers, or that keep old DHCP DNS as a fallback, can send names out the side. A good client pins DNS to the tunnel for included traffic. Typing a public resolver into three places makes it worse.

Router VPN is a different topology. This article is device apps. Do not mix a house-wide router tunnel into a laptop-app ticket without saying so.

It cannot make you anonymous. Accounts, cookies, payment, and the face you put on camera still identify you. Read What a VPN Cannot Do. Tunnel DNS only moved the name hop.

It cannot replace HTTPS. RFC 8446 is still the web's TLS. It cannot stop phishing. The resolver will happily answer a fake bank's name if that name exists. It cannot stop malware, back up your disk, or pick a stream with a guarantee.

It cannot fix IPv6 by itself if the client ignored v6. That is the IPv6 leak article. It cannot fix WebRTC by itself. Klox lists WebRTC leak blocking as a feature. Test that as WebRTC, not as DNS.

It cannot change DNS on the four other devices when you only connected one. Five seats, five stubs. It cannot survive you pasting 8.8.8.8 into the adapter and then blaming the app. The default is tunnel DNS. Own the opt-out.

Success looks like this. You connected Klox. You understand names should now be answered through the tunnel, not by the ISP. You did not paste a public resolver into the NIC. You did not enable browser DoH as a second religion. You know leak tests exist, and you will use those posts when you want a procedure. You know IPv6 and WebRTC are siblings, not synonyms.

Failure looks like a folder of best DNS articles, three resolvers on the adapter, Chrome DoH to a fourth, split tunnel on the browser, and a review that says the VPN leaks because a farm taught you to undo the hop.

Install from download. Pricing is yearly from $2.83 a month, five devices, seven-day money-back. WireGuard until UDP is rude, then OpenVPN. Leave DNS on the default: through the tunnel. Close the extra tabs. The phone book moved. That was the job.