How do DNS leaks happen?
Before your browser can load a site it asks a DNS server to translate the domain into an IP. A correctly configured VPN answers those lookups inside the encrypted tunnel. But operating systems love to "help": Windows smart multi-homed resolution, manually configured DNS servers, or IPv6 lookups on a v4-only tunnel can all slip queries out to your ISP — that's a leak, and your ISP logs every domain.
What does a clean result look like?
With your VPN connected, the location shown above should match your chosen VPN exit, not your real city. For a full resolver-level check, connect and disconnect the VPN and compare: if the visible location and IP change but your browsing "feels" tied to your real region (localized results, ISP block pages), DNS may still be leaking — see the fixes in the FAQ.
How Secure Paid VPN prevents DNS leaks
Every protocol we ship — WireGuard, OpenVPN, and IKEv2 — pushes DNS servers that live inside the tunnel, so lookups ride the same encryption as your traffic. The kill switch drops all traffic, DNS included, if the tunnel ever fails.