NordVPN routes your DNS queries through its own encrypted servers by default, which is exactly what you want from a privacy-focused VPN. But that default behaviour can break internal network resources, cause unexpected slowdowns, conflict with Pi-hole or NextDNS setups, or produce subtle DNS leaks when the kill switch misfires. Whether you are troubleshooting a DNS leak, trying to point NordVPN at a custom resolver, or dealing with a corporate split-tunnel that stopped resolving internal hostnames after a client update, this guide covers every layer of NordVPN DNS configuration with exact steps and verifiable commands.

How NordVPN Handles DNS by Default

When you connect to a NordVPN server, the client pushes two proprietary DNS server addresses to your operating system and replaces whatever resolver you had configured. The addresses NordVPN currently uses are 103.86.96.100 and 103.86.99.100. These are NordVPN-operated, non-logging resolvers that run inside the VPN tunnel, so every DNS query is encrypted and exits through the same server jurisdiction as your traffic.

On Windows, the client modifies the adapter settings for the NordLynx or OpenVPN TAP interface and sets those DNS servers at the interface level. On macOS it uses the network service order to push the VPN interface to the top. On Linux, depending on the distro, it either edits /etc/resolv.conf directly or uses systemd-resolved. Android and iOS handle DNS through the WireGuard or IKEv2 tunnel configuration pushed by the app.

The important consequence: if the VPN drops unexpectedly and the kill switch is not enabled, your OS may fall back to your ISP resolver for a window of several seconds before the kill switch fires. That is a real leak vector, and it is the most common reason people end up here.

Checking for a DNS Leak Right Now

Before changing anything, confirm whether you actually have a leak. Run the following commands in a terminal while connected to NordVPN. The goal is to see NordVPN's resolvers — not your ISP's — answering queries.

## Windows (PowerShell) Resolve-DnsName -Name whoami.akamai.net -Server 8.8.8.8 nslookup myip.opendns.com resolver1.opendns.com ## macOS / Linux dig +short TXT whoami.ds.akahelp.net dig +short myip.opendns.com @resolver1.opendns.com ## Check which DNS server actually answered dig +stats google.com | grep SERVER

If the SERVER line or the returned IP points to your ISP's resolver (e.g., 75.75.75.75 for Comcast or 8.8.8.8 for a Google-configured router), you have a leak. If it shows 103.86.96.100 or 103.86.99.100, NordVPN is handling DNS correctly.

💡 For a browser-based check, use the DNS Propagation Checker to see which resolver is visible from multiple global vantage points simultaneously — it is faster than running manual dig commands from one location.

Enabling the Kill Switch to Prevent Leak Windows

The NordVPN kill switch blocks all internet traffic if the VPN tunnel drops, eliminating the fallback window where your ISP resolver gets used. It is off by default. Enable it before doing anything else if privacy is your goal.

  1. Open the NordVPN desktop app and click the Settings gear icon (top-left on Windows, top-right on macOS).
  2. Click General.
  3. Toggle Kill Switch to On. On Windows there is a second option called App Kill Switch which only kills selected apps rather than all traffic — for DNS leak prevention, use the full kill switch.
  4. On Linux via the CLI: nordvpn set killswitch on

On Android, the system-level kill switch (not NordVPN's) is more reliable. Go to Settings > Network & Internet > Advanced > VPN, tap the gear next to NordVPN, and enable Block connections without VPN. This forces Android to drop packets rather than leak through the default interface if the tunnel drops.

Setting Custom DNS Servers in NordVPN

NordVPN lets you override its default resolvers with any DNS server you choose — useful if you run Pi-hole, NextDNS, Cloudflare with malware blocking (1.1.1.2), or a corporate internal resolver.

Desktop App (Windows and macOS)

  1. Open NordVPN and go to Settings > General.
  2. Scroll to the DNS section and disable Use NordVPN DNS.
  3. Enter your preferred primary DNS (e.g., 1.1.1.1 for Cloudflare or your Pi-hole LAN IP such as 192.168.1.100).
  4. Enter a secondary DNS if desired (e.g., 1.0.0.1).
  5. Click Save and reconnect the VPN for the change to take effect.

Linux CLI

## Disable NordVPN's default DNS and set custom servers nordvpn set dns 1.1.1.1 1.0.0.1 ## To use Pi-hole on your local network (LAN IP example) nordvpn set dns 192.168.1.100 ## To revert to NordVPN's own resolvers nordvpn set dns off ## Confirm current settings nordvpn settings | grep -i dns

One important caveat on Linux: if you set a LAN IP as your DNS server and connect to a remote NordVPN server, the tunnel will try to reach that private IP over the encrypted interface. This only works if you have also configured split tunneling to keep local LAN traffic outside the tunnel, or if NordVPN's subnet routing allows it. Otherwise DNS will time out silently and your browser will show generic connection errors.

Android and iOS

The NordVPN mobile apps do not currently expose a custom DNS field in the UI. Your options are:

  • Use the system-level Private DNS feature on Android 9 and later (Settings > Network > Advanced > Private DNS) with a DoT hostname like one.one.one.one for Cloudflare or your NextDNS profile hostname. This runs outside the VPN tunnel, which is a trade-off.
  • Sideload a NordVPN config file (OpenVPN .ovpn) modified with dhcp-option DNS lines pointing at your resolver, then import it into a third-party OpenVPN client. This gives you full control but loses automatic server selection.

Fixing Broken Internal DNS Resolution on Corporate Networks

This is one of the most common NordVPN headaches in workplace environments. You connect to NordVPN, and suddenly intranet.company.com stops resolving because NordVPN replaced your corporate DNS with its own. The fix is split tunneling combined with a routing rule for your internal DNS server.

  1. In NordVPN desktop, go to Settings > Split Tunneling and enable it.
  2. Add any apps that need internal DNS (your browser, Slack, your VPN client for corporate resources) to the exclusion list if you want them to bypass NordVPN entirely, or use the inverse mode to route only specific apps through NordVPN.
  3. Set your custom DNS to your corporate DNS server IP (ask IT — usually something like 10.0.0.2 or 172.16.0.10).
  4. Set the secondary DNS to NordVPN's public resolver (103.86.96.100) so external hostnames still resolve.

If your corporate resolver is only reachable inside the corporate network (common with on-premises Active Directory), you may need to connect to the corporate VPN first, then NordVPN second — or run both split-tunneled. This is genuinely complex; the cleanest solution is to run a local forwarder like dnsmasq that sends .company.com queries to the internal server and everything else to NordVPN's resolver.

## Example dnsmasq config on Linux/macOS ## /etc/dnsmasq.conf server=/company.com/10.0.0.2 server=/internal.local/10.0.0.2 server=103.86.96.100 server=103.86.99.100 listen-address=127.0.0.1 bind-interfaces

After saving, restart dnsmasq and point your OS resolver to 127.0.0.1. NordVPN custom DNS should be set to 127.0.0.1 (or disabled so the OS setting takes precedence).

NordVPN DNS on Routers

If you run NordVPN at the router level — common on Asus, Netgear, GL.iNet, or flashed DD-WRT / OpenWrt hardware — DNS behaviour is different. The router handles the tunnel, and all devices on the LAN get DNS through the router's DHCP. Router-level NordVPN does not push NordVPN's DNS automatically in most firmware unless you configure it.

Access your router admin panel:

On Asus Merlin, navigate to WAN > Internet Connection > WAN DNS Setting and set the DNS servers to 103.86.96.100 and 103.86.99.100. Also go to LAN > DHCP Server and ensure the DNS1 field there also points to NordVPN's resolvers or your Pi-hole IP, not your ISP's assigned DNS. Otherwise your LAN devices bypass the VPN DNS regardless of what the WAN interface uses.

On OpenWrt, edit /etc/config/dhcp and set the option server list to NordVPN's IPs, then run service dnsmasq restart.

Verifying Your DNS Configuration After Changes

After any change, reconnect NordVPN and verify with the following sequence. The goal is to confirm the correct resolver is active and there are no leaks.

## 1. Confirm your public IP is the VPN server, not your real IP curl -s https://ifconfig.me ## 2. Confirm which DNS server is answering dig +short TXT o-o.myaddr.l.google.com @ns1.google.com ## 3. Query a known hostname through the system resolver (no explicit server) dig google.com ## Look for the SERVER line in the output — it should be 127.0.0.1 (dnsmasq) ## or 103.86.96.100 if using NordVPN direct DNS ## 4. Test that internal hostnames resolve (corporate scenario) dig intranet.company.com ## 5. Check for DNSSEC support (NordVPN resolvers support it) dig +dnssec sigok.verteiltesysteme.net | grep -i ad

Use the DNS Lookup tool to perform an external check of your domain's DNS records and confirm nothing unexpected is appearing in your public-facing DNS data as a result of your VPN or resolver configuration.

Common NordVPN DNS Error Scenarios and Fixes

DNS stops resolving after sleep or resume

This is a known issue on Windows where the NordLynx adapter loses its DNS server assignment after the system wakes from sleep. The VPN tunnel reconnects but Windows restores the old adapter state without reapplying NordVPN's DNS push. Fix: enable Auto-connect in NordVPN settings so it reconnects fully on resume, which re-pushes the DNS. Alternatively, set a static DNS in the NordLynx adapter properties directly via Network Connections > NordLynx adapter > Properties > IPv4 > Use the following DNS server addresses.

Websites load but some apps cannot resolve hostnames

Some applications bypass the system resolver and use hardcoded DNS-over-HTTPS endpoints (Chrome, Firefox, some Electron apps). NordVPN's DNS override does not intercept DoH. Go into your browser's settings and disable Secure DNS or point it explicitly at NordVPN's resolver by entering https://103.86.96.100/dns-query if DoH is supported (it is), or simply disable DoH and let the system resolver handle it.

IPv6 DNS leaks

NordVPN blocks IPv6 by default on desktop clients. If you have manually re-enabled IPv6 on your adapter, your system may send DNS queries over IPv6 outside the tunnel. Disable IPv6 on the physical network adapter in Windows Device Manager or via sysctl -w net.ipv6.conf.all.disable_ipv6=1 on Linux unless you have a specific need for it.

Best Practice Summary

  • Enable the kill switch before relying on NordVPN for DNS privacy.
  • Use NordVPN's own resolvers (103.86.96.100 / 103.86.99.100) unless you have a specific reason to override them.
  • If you run Pi-hole or NextDNS, set the custom DNS in the NordVPN app to your resolver's IP and test that the VPN tunnel can reach it.
  • For router deployments, manually set DHCP DNS to NordVPN's resolvers on the LAN side — do not rely on the router to inherit it automatically.
  • Disable browser-level DoH if you want NordVPN's resolver to handle all queries.
  • Re-verify after every major NordVPN client update — DNS push behaviour has changed across versions.