Can DNS bypass a VPN?

Yes. Operating-system settings, client design, split tunneling, Private DNS, and DoH can create resolver paths different from the main tunnel.

Are Private DNS and DoH the same thing?

They both encrypt DNS in common deployments, but they can operate at different layers and use different resolver endpoints and policy controls.

Why do only some sites fail through a VPN?

Possible causes include DNS answers, IPv6 routing, MTU, cached records, or a destination-specific route. A working site does not validate every layer.

Should I always force a public DNS resolver?

No. It can be a useful comparison, but the intended resolver path should be understood and fixed rather than permanently hidden by a workaround.

DNS Through a VPN: Private DNS, DoH, Leaks and Partial Site Failures

Published September 9, 2026Updated September 9, 2026INFOCROSS editorial team

Privacy and access

Key takeaways

A VPN tunnel and a DNS resolver are related but separate layers; traffic can use the tunnel while name resolution follows another path.

Private DNS and DoH encrypt DNS, but they can also bypass the resolver assigned by a VPN when the operating system or browser applies its own policy.

Partial site failures can come from DNS, IPv4 versus IPv6, MTU, or cache state, so diagnose specific domains instead of relying only on a public IP check.

DNS behavior can change independently of the tunnel

A VPN client may assign a resolver to the operating system or intercept DNS through its own mechanism. The final path still depends on the OS, browser, and split-tunnel policy. A browser with DoH can query its selected resolver even when the system is configured differently. Platform Private DNS features can introduce another resolver path.

A changed public IP therefore does not prove that DNS follows the intended route. Inspect the resolver state separately, including what happens after reconnect and whether a domain resolves differently with the VPN enabled.

DNS leaks and partial failures are not the same diagnosis

A DNS leak usually describes name queries leaving the expected VPN path toward another resolver. Partial site failure has more possibilities: a resolver can return a different address, IPv6 may follow another route, cached records may be stale, or packet sizing can affect larger exchanges.

When only certain domains fail, compare their resolution and clear stale cache after changing DNS. Switching to a public resolver can be a useful experiment, but it should not replace understanding why the intended resolver failed.

Test Private DNS and DoH one layer at a time

Record the current configuration first. Temporarily remove custom DNS overrides and test the resolver assigned by the VPN. Then enable system Private DNS or browser DoH separately and repeat the same domain set. A failure that appears only in one configuration localizes the problem.

After reconnect, confirm that resolver state recovers together with routing. With split tunneling, determine which path the application issuing the DNS request actually uses. A healthy design remains predictable after network changes and client restarts, not only during one leak test.

All in this topic

How to Check Whether a VPN Works on Your Network: A Reproducible MethodOpen article How to Test a VPN on Mobile Networks: Latency, Loss, Reconnect and HandoverOpen article VPN Connected but Sites Hang: MTU, PMTUD and Black-Hole ConnectionsOpen article ChatGPT Won't Load or Keeps Stalling: Separate VPN, DNS, WebSocket and Policy ErrorsOpen article