Configure Pi-hole and VPN DNS to Prevent Leaks.
Configure Pi-hole to handle DNS across IPv4 and IPv6, and check that your VPN keeps DNS queries inside its tunnel. This guide explains the difference, safer setup choices, and how to test for unexpected DNS resolvers.
A DNS setup can behave differently across your home network and a VPN. Your router may tell devices to use Pi-hole over IPv4 but advertise another resolver over IPv6. A VPN may route IPv4 through its tunnel while handling IPv6 or DNS separately.
This guide explains how to configure Pi-hole for network-wide DNS filtering, what to check when using a VPN, and how to test whether queries are reaching an unexpected resolver.
DNS leak
A DNS lookup translates a domain name, such as example.com, into an IP address. A DNS leak usually means a device sends those lookups to a resolver outside the one you intended—for example, your ISP’s resolver instead of the VPN’s resolver.
The resolver that receives a query can see the domain being looked up. Traditional DNS is usually unencrypted between a device and its resolver, so other parties on the network path may also be able to observe it. Encrypted DNS protects that connection from passive observers, but the DNS provider still receives the queries.
A leak does not necessarily reveal every page you visit: browsers and apps may cache results, and one domain can serve many sites. The practical question is whether DNS queries are reaching a resolver you did not choose.
Why IPv6 settings matter
IPv4 and IPv6 can use different DNS servers and network routes. For example, a router may advertise Pi-hole as the IPv4 resolver but provide an ISP DNS server through IPv6 Router Advertisements or DHCPv6. A VPN may also handle IPv6 differently from IPv4.
IPv6 itself is not a DNS leak. The problem is inconsistent DNS or routing configuration across network interfaces and protocols. If you want devices at home to use Pi-hole, configure it for both IPv4 and IPv6. If you want VPN privacy, check how the VPN handles both DNS and IPv6.
Configure Pi-hole for your home network
- Give the Pi-hole host a stable address on your network.
- In your router’s DHCP settings, set the IPv4 DNS server to Pi-hole’s IPv4 address.
- If IPv6 is enabled, configure the router’s DHCPv6 or Router Advertisement (RDNSS) settings to advertise Pi-hole’s reachable IPv6 address as DNS. Router menus and supported methods differ.
- Reconnect client devices or renew their network leases, then check their DNS settings and Pi-hole’s Query Log.
Pi-hole’s documentation describes distributing its DNS address through router DHCP settings. Its router-specific guidance also covers advertising Pi-hole over IPv6. Ensure the Pi-hole host itself has a working upstream DNS resolver.
If your router cannot advertise Pi-hole over IPv6, consult its documentation for available options. Depending on the router, you may be able to change IPv6 DNS advertisements or disable IPv6 on the local network. Disabling IPv6 is a trade-off that can affect connectivity; it is not the default fix.
Some devices and browsers may use a manually configured resolver or DNS-over-HTTPS (DoH), bypassing the DNS server advertised by the router. A router firewall can block or redirect conventional DNS traffic on port 53, but that does not reliably stop DoH, which uses HTTPS on port 443. DNS-over-TLS commonly uses port 853. Enforcing a DNS policy requires router and device controls appropriate to your network.
Check DNS behavior with a VPN
When connected to a VPN, check the VPN provider’s documentation and client settings for:
- IPv6 support, or an option to block IPv6 while the VPN is connected.
- DNS servers supplied by the VPN.
- A kill switch or firewall rules that prevent traffic from leaving outside the tunnel if it disconnects.
Do not disable IPv6 on the Pi-hole host as a general VPN fix. The relevant settings are on the device using the VPN: its DNS configuration, routing, and the VPN client’s IPv6 behavior. If the VPN does not tunnel IPv6, use its documented IPv6-blocking feature if available, then test the connection.
Avoid locking /etc/resolv.conf
Do not replace /etc/resolv.conf and make it immutable with chattr +i as a general fix. Many Linux systems have NetworkManager, systemd-resolved, or another network manager maintain DNS settings, and /etc/resolv.conf may be a symlink to a generated file. Locking it can interfere with network changes and VPN DNS configuration.
On a Linux system using systemd-resolved, inspect the current resolver setup with:
$ resolvectl status
On other systems, use the network manager’s DNS status tools. Change DNS through the component that manages the connection, such as your router’s DHCP/IPv6 settings or your operating system’s network settings.
Test your setup
Test VPN DNS
Connect to the VPN, then run a DNS leak test such as DNS Leak Test or BrowserLeaks DNS. Review which resolver organizations appear. The results should be consistent with your VPN provider’s documented DNS behavior; seeing an unfamiliar location or company name alone does not prove a leak.
Test Pi-hole DNS
Generate a few lookups from a client device and check Pi-hole’s Query Log. Also inspect the client’s DNS configuration. On Linux with systemd-resolved, run:
$ resolvectl status
Test over IPv4 and IPv6 if both are enabled. Repeat after reconnecting to Wi-Fi or restarting the VPN. A single website test cannot prove that every app uses the same DNS path.
Use the router to advertise Pi-hole over IPv4 and IPv6 if you want network-wide filtering. When using a VPN, confirm that it routes DNS and handles IPv6 according to your privacy requirements. Avoid disabling IPv6 or locking resolver files as blanket fixes, and test from the devices and connections you actually use.
We hope this was helpful.
Keep learning. Keep exploring. Stay secure.
