Updated July 10, 2026 — Alex Rivera, Technology Editor, VPN Security Review.
Who: VPN users—privacy-minded individuals, journalists, IT hobbyists, and small businesses.
What: A July 2026 update showing which VPN setups still leak DNS intermittently, new trends driven by DNS-over-QUIC (DoQ) and OS changes, and concrete, short-term fixes.
When: Testing and reporting completed between June 15 and July 5, 2026.
Where: Consumer laptops and phones (Windows 11, macOS, Android 14+, iOS 17+), home routers (stock firmware and OpenWrt), and mixed router/device VPN setups.
Why it matters: DNS queries reveal which domains you visit and are often more identifying than a masked IP. Intermittent leaks—those that appear only during roaming, sleep/wake, or DNS protocol toggles—are stealthy and common in 2026’s more complex resolver landscape.
What’s changed since April 2026
Two months into mid‑2026 we see three clear shifts that make DNS leaks both subtler and more frequent if you’re not explicit about resolver routing:
- DoQ is real now: DNS-over-QUIC (DoQ) is increasingly offered by major public resolvers (Cloudflare, Google, Quad9) and supported in browser and OS stacks. DoQ uses QUIC (the same protocol that powers HTTP/3), which means DNS can take a different network path and a different socket race than DoH/DoT did before it.
- OS vendors adding “VPN-aware” DNS controls—but unevenly: Windows and Android rolled out VPN-aware encrypted DNS toggles in H1 2026; macOS and some Linux distros lag. Where present, those controls still require explicit binding to the VPN interface to work reliably.
- Router ecosystems are more opinionated: Home gateway vendors and projects like OpenWrt now include per-VLAN DoH/DoQ toggles and DNS filtering. That’s powerful, but misconfigurations create new bypasses when device and router DNS policies disagree.
July 2026 lab results — what we tested and what we found
Method: VPN Security Review ran repeatable tests on 12 widely used consumer VPN clients across Windows 11, macOS Sonoma, Android 14, and iOS 17, plus mixes of router firmware (stock and OpenWrt 22.03+). Scenarios included roaming (Wi‑Fi ↔ mobile hotspot), sleep/wake, captive portal recovery, browser DoH/DoQ toggles, and IPv6-enabled LANs.
Headline numbers: 12 apps tested; 3 exhibited repeatable intermittent DNS leaks under at least one scenario. The most common triggers were network transitions (2 of 3) and hard-coded DoQ/DoH endpoints at the browser or OS level (all 3).
“DoQ reduced latency but added a new socket race: if the resolver’s QUIC endpoint is reachable outside the tunnel, queries go there first.” — Alex Rivera, VPN Security Review lab lead
Top leaking setups in July 2026 — updated fixes
The nine categories from April still apply; below I highlight the ones that shifted in July and what to do now.
1) Browser DoH/DoQ set to a public endpoint outside your VPN
Browsers that support DoQ (or DoH) can be pointed to a resolver address that bypasses the tunnel. In July we saw Chrome and Edge prefer DoQ endpoints when available, and those endpoints sometimes won the race against the VPN’s DNS.
Fast fix: In Chrome/Edge, set secure DNS to “Use provider defined by system” or explicitly disable browser DoQ/DoH while you’re connected to a VPN that enforces its own DNS. In Firefox, set TRR (Trusted Recursive Resolver) mode to “off” or “reserved_by_vpn” where supported. If your VPN client has “force DNS” or “bind DoH/DoQ to tunnel,” enable it.
2) OS encrypted DNS controls that aren’t bound to the VPN
Windows and Android now offer VPN-aware options, but they require configuration. If your OS points encrypted DNS to a specific hostname that resolves outside the tunnel, that resolver may be used before the VPN’s resolver.
Fast fix: Use OS settings that say “automatic” or “follow VPN” while connected. On managed devices, deploy MDM profiles that set encrypted DNS behavior when a specific VPN profile is active.
3) IPv6 remains the sneakiest vector
As more ISPs and mobile networks push IPv6, we still see DNS slipping over IPv6 when clients handle only IPv4 DNS through the tunnel.
Fast fix: Prefer VPN clients with full IPv6 DNS support. If your client lacks it, temporarily disable IPv6 on the device or push an RA/DNS filter at the router until you can migrate to a client that anchors IPv6 DNS inside the tunnel.
4) Router-level DoQ and per-VLAN resolvers
New router options allow per-VLAN DoQ endpoints. If your streaming VLAN uses smart DNS and your device VPN connects to the default VLAN, DNS can intentionally escape.
Fast fix: Keep streaming/smart-DNS VLANs separate from privacy VLANs. For whole-home privacy, run the VPN on the router and set all VLANs to route DNS through the server—or run device VPNs and keep router DNS minimal.
The updated 3–5 minute test that catches intermittent leaks (July 2026)
- Connect your VPN and run a DNS leak check (dnsleaktest.com, ipleak.net).
- Toggle browser secure DNS to a public resolver (Cloudflare/Google/Quad9) then re-run the test—note any resolver changes.
- Put the device to sleep for 60 seconds, wake it, and retest.
- Switch networks (Wi‑Fi ↔ mobile hotspot) without restarting the browser; retest.
- If you can, run a packet capture (tcpdump or Wireshark) for 30 seconds while performing these steps and filter for UDP port 53, TCP 853 (DoT), and QUIC traffic (UDP port 784 or the resolver’s custom port). Look for DNS going to non‑VPN interfaces.
If a resolver switches to an ISP or public address during any step, you have a repeatable leak condition.
Impact — who should act now
If you care about unlinkability across sessions—journalists, activists, corporate remote workers, or anyone using VPNs for privacy or circumvention—you need to test for intermittent leaks. Casual users who only check “green connected” are especially at risk because leaks often appear only during real‑world interruptions: travel, sleep, captive portals, or when a browser updates and flips to DoQ.
Reactions and what vendors are doing
VPN vendors we contacted (names withheld at their request) say they’re shipping updates that bind DoH/DoQ to the tunnel and improving kill-switches. Router and resolver projects are adding explicit “bind resolver to interface” options in their GUIs. These are positive steps, but they require users and administrators to flip the right toggles.
What’s next (July–Q4 2026)
- Expect wider client support for binding DoQ/DoH to VPN interfaces—watch release notes for “bind resolver to tunnel” or “VPN-aware DNS.”
- Look for router firmware updates that add interface-based resolver rules and per‑VLAN DoQ controls; test after any update.
- Vigilance: as encrypted DNS gets faster and more ubiquitous, DNS will move even more into the “race” layer—making repeated testing part of your privacy hygiene.
The bottom line
Encrypted DNS improved on-path privacy, but in 2026 it’s also added more moving parts that can bypass your VPN if not explicitly bound to it. Test for leaks during real-world transitions, prefer VPN clients that anchor both IPv4 and IPv6 DNS, and pick one predictable DNS authority per privacy profile.
FAQ — quick answers
How do I know if a DNS leak is intermittent or persistent?
Run the updated 3–5 minute test above (sleep/wake, roaming, browser DoQ toggle). If resolvers change only during those steps, the leak is intermittent and reproducible; persistent leaks show up immediately and every time.
Is DoQ better or worse for VPN users?
DoQ reduces latency and can be more robust than DoH/DoT, but it also creates a QUIC-based socket race. DoQ is “better” only when the DoQ endpoint is routed through the VPN. If it’s reachable outside the tunnel, it can bypass your VPN just as any hard-coded resolver can.
Should I disable IPv6 to stop leaks?
Disabling IPv6 is a pragmatic short-term fix if your VPN client doesn’t enforce IPv6 DNS. Long term, prefer clients that support IPv6 end-to-end or configure router-level controls. Disabling IPv6 can break some services, so plan accordingly.
Can I fix leaks without changing router firmware?
Often yes: enable the VPN client’s “force DNS” or “bind DNS to tunnel” options, set browsers to “system” secure DNS mode, and use the client’s kill switch. If leaks persist across devices on your network, router-side fixes will likely be necessary.
If this update helped you find a leak, tell the friend who said “I tested once and I’m fine.” Send reproducible steps, timestamps, and packet captures to your provider’s support and, if helpful, to lab@vpnsecurityreview.com—we’ll follow up on common failure modes.