DNS vs VPN: What Each One Actually Does

A couple of years ago I changed the DNS settings on my home router, picked a resolver that promised privacy, and felt quietly pleased with myself. A few months later I bought a VPN subscription for the same reason. Both times I believed I had 'gone private'. Both times I was wrong in an interesting way, and it took some packet-level poking around before I understood what I had actually bought each time.

The confusion is understandable, because the two are sold with the same words. But DNS and VPNs operate at completely different points in your connection, and once you see that, the rest — leaks, region tricks, speed — falls into place.

Start with what a lookup actually is

Before your browser can load example.com, it needs that name translated into an IP address. It asks a DNS resolver, which answers with something like 203.0.113.25. That question-and-answer is a lookup: tiny, quick, and separate from the actual visit. Only after the answer comes back does your browser open a connection to that address and fetch the page.

Keep those two stages apart in your head, because the whole DNS-versus-VPN question lives there. Changing DNS touches only the first stage. A VPN takes over the second stage as well.

What changing your DNS really does

Switching resolvers — by hand, or by using encrypted DNS in the browser — changes who answers the questions. Your ISP's resolver stops seeing a diary of every name you look up, and the new resolver starts seeing it instead. A filtering resolver can refuse names known for malware or ads. A resolver based in another country can matter for services that decide what to show you based on where the lookup appears to come from, which is the entire trick behind smart DNS services.

The region angle deserves honesty, too. Some services check where your resolver appears to be, rather than where you are, because lookups were historically a decent proxy for location. That is the entire basis of smart DNS: not encryption, not a tunnel, just answers chosen to point you at a proxy elsewhere. The moment a service checks your connection's address instead — as most do — the trick stops working, which is why smart DNS unblocks some catalogues and does nothing for others.

And that is roughly the whole list. The visit itself is unchanged. Your data still leaves your house on your own connection, under your own IP address, and the sites you visit see you exactly as before. Your ISP can no longer read the lookups if the resolver traffic is encrypted, but it can still see which IP addresses you connect to. I had changed the phone book, not the road.

What a VPN really does

A VPN wraps all of your traffic — lookups and page fetches alike — in an encrypted tunnel to a server run by the VPN provider. That server then talks to the internet on your behalf. Websites see the VPN server's address instead of yours. Your ISP sees one encrypted stream to one destination and not much else.

Notice what quietly happened, though: the trust did not disappear, it moved. The VPN provider can now observe what your ISP used to observe, because everything you do passes through their machines. A VPN is a change of who watches, not an end to being watched, and the word 'anonymous' in marketing deserves the skepticism that a plain DNS leak explanation applies to leaks.

There is a plumbing detail worth knowing, because it explains the leaks in the next section. Under the hood, a lookup is a tiny packet sent to the resolver's address — port 53 for plain DNS — while a VPN moves everything, every packet for every program, into its tunnel. When the tunnel's rules forget to include those small lookup packets, they slip out on the normal network. Different stages, different failure modes.

Side by side

The last row is the one vendors would rather you skipped. Neither tool erases the accounts you log into, the cookies sites set, or the fingerprint your browser presents. Log into your email over a VPN and that service knows exactly who you are — it just sees a different return address.

One page load, both ways

Make it concrete. You type a shop's name into your browser on café Wi-Fi. With only a DNS change in place, your lookup goes to the resolver you chose — encrypted, if you set it up that way — and comes back with the shop's address, say 198.51.100.25. Then your laptop connects directly to that address, across the café network, in the open. The shop sees your laptop's real address. The café's router sees where you went and how much data flowed. The diary of names moved house; the journey did not change at all.

Same café, VPN switched on. The lookup now happens inside the tunnel, answered by the VPN's resolver. The page fetch travels inside the tunnel too, to the VPN's server, which fetches the page and relays it back to you. The café sees one encrypted stream to one destination. The shop sees the VPN server's address, in the VPN server's country. Notice the bystander, though: he has not left the theatre. He has changed chairs, from the café's router to the VPN provider's server room.

There is a hybrid worth naming, because it produces baffling leak reports: split tunnelling. Many VPN clients let you exempt chosen apps from the tunnel, so the banking app uses your real connection while the browser rides the VPN. Those exempt apps' lookups travel outside too, answered by your ordinary resolver. That is not a bug or a betrayal — it is the feature working — but it means “the VPN is on” stops being a complete description of your traffic. Two lanes, two sets of witnesses, and a leak test that samples only one lane will always tell you half the story.

The awkward middle case: DNS leaks under a VPN

Here is where the two collide. A VPN is supposed to route lookups through the tunnel too, using its own resolvers. But operating systems and browsers sometimes send lookups outside the tunnel to the old resolver, often the ISP's. The page traffic is hidden while the lookup diary leaks out the side door — that is a DNS leak, and it is why a changed DNS setting, like the ones in this guide to switching servers, can quietly fight a VPN instead of helping it.

Because the two tools share vocabulary, people combine them in ways that quietly undo each other. The recurring ones:

• Setting a custom resolver for privacy, then running a leak test that blames the VPN — when the escaping lookups are your own setting, doing exactly what you told it to do.
• Buying smart DNS for privacy. It offers none: the lookups are its entire product, and your traffic stays precisely where it was, under your own address.
• Running a VPN for region reasons while the browser's own encrypted DNS sends lookups to a resolver in your real country. Some services read the lookup's apparent location, so one half of you appears to be abroad and the other half at home.
• Stacking both tools and blaming the slowdown on whichever was installed last. The tunnel taxes every byte you move; the resolver only ever taxed the questions.

None of these are exotic configurations. I have personally built two of them, each time by adding a sensible tool to a setup that already had one, and never checking what the combination actually did. The check takes five minutes and one honest question: for a single lookup, and for a single page load, whose machines am I actually using?

So which one do you need?

Ask what you are actually trying to fix. Lookups visible to your ISP, or slow and filtered answers? Change the resolver — it takes minutes and costs nothing. Connecting from an untrusted network, or needing sites to see a different network location? That is the VPN's job, tunnel and all. Many people reasonably run both, set up so the VPN handles the lookups while it is connected.

What neither purchase buys you is invisibility. Treat any tool promising that as a story — and if you want to check what your own setup is really exposing, the lookups are the first place to look.