Skip to content

DNS

Open Settings → DNS. After changing connection-related options, reconnect the VPN. Your subscription or selected routing profile may already configure DNS; in that case, app options may not replace its rules.

Local DNS

Off by default · port 10853. Enables a local DNS service. Leave it off unless your setup needs it. If you enable it, keep the suggested port unless another local service uses it, then reconnect.

DNS leak protection

On by default. Sends ordinary DNS traffic through the VPN rules. Leave it enabled unless your provider asks you to change it. It does not replace the privacy settings of a browser or app that uses its own encrypted DNS.

DNS-over-HTTPS (DoH)

Off by default. Uses HTTPS for DNS lookups configured by the app. This concerns website and service names during the VPN connection.

  1. Enable DNS-over-HTTPS (DoH).
  2. Enter the complete HTTPS resolver URL supplied by your provider, or leave the field empty to use the app's default.
  3. Reconnect and check that websites load.

A subscription with its own DNS configuration can determine the actual resolvers and routes. DoH encrypts lookups to the resolver; it does not by itself guarantee that every DNS request uses the tunnel.

Server address over DoH

Off by default. Looks up the address of the VPN server before connecting. Try it when your network returns an incorrect address for the server name. It is separate from DoH for websites above.

  1. Enable Server address over DoH in this DNS section.
  2. Enter the complete URL in DoH resolver if your provider supplied one; otherwise leave it empty.
  3. Leave Resolver IP empty unless your provider supplies a specific address. This helps reach the resolver when its own name cannot be resolved.
  4. Reconnect to the same VPN server.

A server specified directly by IP does not need a domain lookup. The subscription or routing profile can supply its own resolver, taking precedence over your local choice.

Fallback DoH resolvers

Off by default. Allows additional built-in resolvers when looking up the VPN server address if the first resolver does not answer. It does not replace every DNS resolver used by websites.

Enable this only if the server-address resolver is unreachable on your network. Additional attempts can increase connection time. If connecting remains slow, disable it again and ask your provider for a resolver reachable from your network.

Checking a DNS problem

Reconnect and try several unrelated sites. If only one site fails, that alone does not establish a DNS problem. Open the connection log and look for lookup errors or timeouts. When contacting support, share the relevant log with the approximate failure time and say which network and server you used.