The Domain Name System, known in short as DNS, is a globally distributed system for translating Internet domains into IP addresses. The DNS translates an IP address corresponding to a domain name and therefore acts as a kind of “address book” for the Internet. Using this analogy, an IP address is equivalent to a postal address, and this is where “packages” of information are sent to. Here are a few examples of DNS queries:
Requested domain | Delivered IP-Address |
“example.com” | “93.184.216.34” |
“ionos.com” | “74.208.255.134” |
For this to work, the IP address of a DNS server must be entered on each end device. The end device sends its DNS queries to this server. The resulting data reveals a lot about the surfing behavior of Internet users. If you want to protect your privacy, you should send outgoing DNS queries only to trusted servers. But what happens if something goes wrong?
Unlike DNS hijacking and DNS spoofing DNS leaks solely effect users who aim to keep their online behavior private. Specifically, users are affected who connect to the Internet via a virtual private network (VPN) or who route a proxy. Both technologies are used to disguise personal identity when using the Internet.
The desire to keep surfing behavior secret does not indicate illegal activities. After all, the right to privacy and informational self-determination are fundamental human rights. Providers of commercial VPN services support this legitimate desire of users against the payment of a fee. The use of proxies, which used to be common, is less common nowadays. We’ll therefore limit our article to the occurrence of DNS leaks when using a VPN.
VPN services aim to route all outgoing network traffic through the VPN. Under certain circumstances, however, individual connections may be routed directly from the user’s device to communication partners on the Internet. A DNS leak occurs when a DNS request that should be sent through the VPN reaches a DNS server unprotected. This is often the DNS server of the Internet service provider (ISP). ISPs are known for collecting, evaluating, and selling the resulting data.
So, what happens when a DNS leak occurs, and what information is leaked out? First, we have to distinguish between three cases:
A DNS query received by the ISP’s DNS server contains the domain name to be resolved in addition to the end user’s undisguised IP address. Time-stamped in the ISP’s server logs, this provides information about when which user wanted to access which domains. This is a serious privacy issue. On the one hand, the DNS data is often packaged into profiles and sold; on the other hand, government agencies can gain access to the data. In the worst case, this can be fatal for dissidents and activists.
DNS requests use the User Datagram Protocol (UDP) as the connection protocol. UDP packets can be seen on their way to the DNS server by any actor who is able to monitor the line. To keep the end user’s surfing behavior private, DNS requests should be routed through the VPN. Since the Snowden revelations, it has been known that intelligence agencies monitor, leak, evaluate, and store Internet traffic on a massive scale. The personally identifiable DNS packets resulting from a DNS leak thus pose a serious threat to the security and privacy of Internet users.
In addition to the dangers already mentioned in connection with DNS leaks, there is another risk. This is because a DNS leak can be exploited by third parties. This can be a service provider, e.g., the operator of a website. The provider can use a technique to determine that a user is accessing the service via a VPN. The ISP of the user may be revealed to the service provider. This, in turn, reveals the user’s approximate geographical location. The same technique is used – for the benefit of the user – by the DNS leak testers.
There are a variety of services that attempt to detect DNS leaks. One such service, known as a “DNS leak tester”, is usually implemented as a normal website that the user accesses via the browser. To test for the presence of a DNS leak, the DNS leak tester triggers a series of special connection attempts. The goal is to trace where the resulting DNS queries originate from. But how exactly does it work?
To understand how a DNS leak tester works, you need to understand how the DNS is structured. The DNS is a hierarchical system of name servers. A distinction is made between authoritative and non-authoritative name servers. An authoritative name server serves as the source of the DNS data of a DNS zone. You can think of a DNS zone as a domain, with additional subdomains.
In addition to authoritative name servers, there are name servers that store parts of the DNS data in a cache. This means that queries that have already been made can be answered quickly without having to check with the authoritative name server each time. The ISP’s DNS server is a non-authoritative name server for most domains. Let’s look at what happens when the ISP’s DNS server receives a request for a domain name:
A DNS leak tester is based on this fundamental principle. Below is an example using the website DNS Leak Test:
It is possible to implement a DNS leak tester as a web service quite easily. For more information, check out this article for a detailed description. If you want to check whether you have been a victim of a DNS leak, you can use one of the existing DNS leak testers. We have compiled a list of these for you here, although this list is by no means exhaustive:
The best strategy to prevent DNS leaks is based on the IT security concept “defense in depth”, in which you build multiple layers to protect against a threat. If a single layer is eliminated, the protection remains in place. We recommend the following steps – in this order – to prevent DNS leaks:
We have compiled a list of various VPN services so that you can get a good overview.
The above points provide a basic level of protection against DNS leaks and should be sufficient for most Internet users. Members of particularly vulnerable groups, such as human rights activists, should take additional precautions:
The Domain Name System (DNS) is considered “the phone book of the Internet”. You can use it to find the right IP address for each URL. However, the system traditionally works without any encryption. Virtually anyone can listen in when you send a request. Not only is this slightly worrying, but it can also be dangerous. DNS over HTTPS tries to close the decade-old security gap.
The Domain Name System has a big security flaw: requests and responses are traditionally sent unencrypted. This provides Internet criminals with an ideal point of attack. Again and again, users are being directed to websites that they actually have no desire to visit. DNS over TLS acts as a deterrent. How does the security concept work?
The DNS is one of the cornerstones of the Internet. To ensure that the resolution of domain names into IP addresses works reliably, the information of a DNS zone is stored redundantly all over the world. But how does the mechanism by which changes are made to the redundant copies work? The answer is rooted in the difference between primary and secondary DNS.
Many Internet users have a basic idea of what the term “domain” refers to. After all, domains are abundant on the Internet via URLs. If you delve deeper into the subject, though, it quickly becomes confusing. “Name server,” “DNS zone,” “zone file”: What do these terms mean, and how are the concepts related? We’ll shed some light on the topic here.
If you change the DNS of a website, it can take hours or even days for the changes to reach each server. This transition phase is called DNS propagation. Our article shows you what it is, where the delay comes from, and how you can easily test DNS propagation.
Provide powerful and reliable service to your clients with a web hosting package from IONOS.
View packages
