How to Fix DNS Leaks on a TP-Link Router

Your VPN shows connected, but a quick test at dnsleaktest.com reveals your real ISP's nameservers in plain sight. That is a DNS leak — and on TP-Link routers, it almost never stems from the cause you first suspect. The fix usually takes under ten minutes, but only when you target the right layer. This guide covers every mechanism that causes TP-Link routers to leak DNS, ranked by frequency, with exact admin panel paths for both old and new firmware generations.

What a DNS Leak Actually Means

Every time you visit a website, your device sends a DNS query to translate the domain name into an IP address. If you are running a VPN, those queries should travel through the encrypted tunnel to your VPN provider's resolvers — not your ISP. A DNS leak is when some or all of those queries bypass the VPN tunnel and reach your ISP instead. Your ISP can then log every domain you visit, even though your traffic appears encrypted from the outside.

The term "leak" is slightly misleading. Nothing is broken per se — DNS queries flow through the path of least resistance, which defaults to your router's own resolver or the ISP-assigned one. Factory TP-Link configurations prioritize reliability over privacy. That is the root of the problem.

Why TP-Link Routers Leak DNS

These are the causes, ranked by how often they appear in practice:

1. VPN Running on a Device, Not the Router

The most common scenario. You run a VPN app on your laptop or phone, but the TP-Link router still acts as the DNS resolver for the LAN. The VPN tunnel carries your web traffic, but DNS queries often slip out through the physical network interface because Windows, macOS, and Android all have their own DNS fallback logic. The router is not the culprit — the operating system is — but fixing the router's DNS settings is still half the solution.

2. IPv6 DNS Requests Escaping the Tunnel

The second most common cause, and the most frequently missed. If your ISP provides IPv6 (most do now) and your TP-Link router has IPv6 enabled — the default on newer Archer AX and BE-series firmware — your devices will send DNS queries over IPv6. Most VPN clients do not capture IPv6 DNS traffic by default. Result: your ISP's IPv6 resolvers answer every query, exposing your full browsing history even with the VPN active.

3. ISP DHCP Override Silently Replacing Your DNS

Some ISPs push their own DNS servers via DHCP Option 6, which overwrites whatever you have configured in the TP-Link WAN settings. This is more common on cable connections (Rogers, Comcast, Shaw, Telus Fibre) than DSL. The router accepts the ISP-pushed DNS without warning, and your custom entries in the admin panel appear correct while being silently ignored at connection negotiation time.

4. Windows Smart Multi-Homed Name Resolution

Windows 10 and 11 include a feature called Smart Multi-Homed Name Resolution (SMHNR), which sends DNS queries to every available network adapter simultaneously and uses whichever responds fastest. If your VPN creates a virtual adapter alongside your physical Wi-Fi adapter, Windows races both paths — and the ISP-assigned resolver on the physical adapter wins more often than not.

5. TP-Link Firmware Auto-Revert After WAN Reconnect

On some older Archer models (C7, C9, C2300) running firmware from 2019 through 2022, the WAN DNS settings revert to ISP-automatic after a WAN link drop and reconnect. Your settings look correct in the panel until the next power cycle, at which point the ISP's DNS takes over again silently. Most of these bugs were resolved in firmware updates shipped after 2023, but unpatched units still show this behaviour.

Step 1 — Confirm the Leak Before Touching Settings

Establish a baseline first. From the device you suspect is leaking, run:

Then visit dnsleaktest.com and run the Extended Test. If you see your ISP's resolver names rather than your VPN provider's or a public resolver you explicitly chose, the leak is confirmed.

Step 2 — Lock Down DNS in the TP-Link Admin Panel

Log in at http://tplinkwifi.net or http://192.168.0.1. Default credentials are printed on the router label. If you have never changed them, do so before leaving this page — factory credentials are publicly documented and trivially exploitable on a LAN.

Archer AX / AXE / BE Series (New UI, 2020 Onward)

1. Click Advanced in the top navigation bar.
2. Go to Network → Internet.
3. Scroll to the DNS section beneath the connection type selector.
4. If you see a toggle labeled Get DNS Automatically or Use ISP DNS Server, turn it Off first. This is the setting most people miss.
5. Set Primary DNS to 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9 with malware blocking).
6. Set Secondary DNS to 1.0.0.1 or 149.112.112.112.
7. Click Save.

Archer C-Series / Legacy UI (C7, C9, C2300, C5400)

1. Go to Advanced → Network → Internet. Switch the DNS field from Auto to Manual and enter your servers.
2. Then navigate separately to Advanced → DHCP → DHCP Settings. Enter the same servers in Primary DNS and Secondary DNS.
3. This second step is critical on legacy firmware. Without it, the router queries the correct upstream resolver, but LAN devices still receive ISP DNS via DHCP and bypass your WAN setting entirely.
4. Save and reboot the router — not just Save. Some legacy builds require a full restart before the upstream DNS change takes effect.

Deco Mesh Systems (M4, M5, M9, XE75, BE85)

Deco units have no browser admin interface for DNS settings. Use the Deco mobile app exclusively:

1. Open the Deco app and tap More in the bottom-right corner.
2. Tap Advanced → DNS Settings.
3. Switch to Custom DNS and enter your preferred servers.
4. Save. The app pushes the config to all nodes in the mesh automatically.

On Deco firmware 1.6 and later, you can also set per-device DNS overrides — useful if only specific devices need a different resolver than the rest of the network.

Step 3 — Eliminate IPv6 DNS Leaks

This step is non-negotiable. Even with IPv4 DNS locked down, your devices will use ISP-assigned IPv6 resolvers pushed via DHCPv6 or Router Advertisement messages unless you address this separately. IPv6 DNS leaks are invisible to most VPN clients and are missed by leak tests that check only IPv4.

Option A — Disable IPv6 on the Router (Cleanest for VPN Users)

1. In the TP-Link admin panel, go to Advanced → IPv6.
2. Set the toggle to Off, or set Connection Type to Disabled.
3. Save and reboot.

This eliminates the IPv6 DNS leak vector entirely. For home VPN use it is the right trade-off — almost no consumer application requires native IPv6 when a VPN tunnel is in play.

Option B — Set Custom IPv6 DNS Servers

1. Go to Advanced → IPv6 and locate the DNS Settings subsection.
2. Set Primary DNS to 2606:4700:4700::1111 (Cloudflare IPv6) or 2620:fe::fe (Quad9 IPv6).
3. Set Secondary DNS to 2606:4700:4700::1001 or 2620:fe::9.
4. Save.

Option B preserves IPv6 connectivity but only prevents the leak if your VPN provider also tunnels IPv6 traffic. Many consumer VPN apps do not. Verify with your provider before relying on this approach.

Step 4 — Fix DNS Leaks at the Device Level

Router DHCP changes affect new leases going forward. Devices that have cached old settings, or that override DHCP at the OS level, need individual attention.

Windows 10 / 11

Also go to Settings → Network & Internet → Wi-Fi → your network → Properties → Edit IP settings → Manual. Set Preferred DNS to your chosen resolver. On Windows 11, you can enable DNS over HTTPS per-adapter in the same dialog — use it if your resolver supports it (Cloudflare and Quad9 both do).

macOS

System Settings → Network → Wi-Fi → Details → DNS tab. Remove any ISP-assigned addresses and add only your chosen servers. Repeat for every Ethernet adapter in use. macOS applies DNS settings per network interface, not globally.

Linux (systemd-resolved)

iOS

Settings → Wi-Fi → tap the (i) next to your network → Configure DNS → Manual. Add your preferred DNS servers and remove the auto-assigned ones. iOS applies this setting per-network, so repeat for each Wi-Fi network you use regularly. iOS does not inherit the router's DHCP-provided DNS once you manually override this field.

Android 9 and Later

Settings → Network & Internet → Private DNS → set to Private DNS provider hostname and enter dns.quad9.net or one.one.one.one. This enables DNS over TLS system-wide, overriding whatever the router provides. It works even on networks you do not control, making it the cleanest Android solution regardless of where you connect.

Verify the Fix With CLI Tools

After all changes are applied, confirm the leak is actually closed:

If nslookup still shows 192.168.0.1 as the answering server and that address is forwarding to ISP resolvers, go back to the DHCP settings on the router and confirm the upstream DNS entries actually saved. Some firmware builds require a full reboot — not just clicking Save — before the new upstream takes effect.

Cross-reference your local results using the DNS Lookup tool to query a domain from external resolvers worldwide — useful for spotting discrepancies between what you see locally and what the public internet sees.

OpenWrt and DD-WRT on TP-Link Hardware

If your TP-Link router runs third-party firmware, the stock panel paths above do not apply.

OpenWrt: Navigate to Network → DHCP and DNS → General Settings. Set DNS forwardings to your chosen upstream servers. To add DNS over TLS, install the stubby package (opkg install stubby) and configure it to forward to dns.quad9.net on port 853. Enable DNSSEC validation in the DNSSEC tab to reject forged responses from upstream.

DD-WRT: Setup → Basic Setup → scroll to Network Address Server Settings (DHCP). Set Static DNS 1 and Static DNS 2 to your resolvers. Check Use DNSMasq for DNS. If your build includes it, enable the DNSSEC checkbox to add validation on top of the custom resolvers.

2026 Considerations: DoH, DoT, and DNSSEC

The DNS privacy landscape has shifted considerably, and several developments affect TP-Link users specifically in 2026.

Browser DoH bypass: Firefox and Chrome now default to DNS over HTTPS using their own upstream resolvers, independent of what the OS or router specifies. Even with your router and OS locked down, Firefox may bypass everything and send queries to Cloudflare over port 443. To disable in Firefox: Settings → Privacy & Security → DNS over HTTPS → Off. In Chrome: Settings → Privacy and Security → Security → Use secure DNS → disable or configure to your current service provider.

TP-Link native DoH support: Archer BE series (Wi-Fi 7 hardware, shipping from late 2024) includes native DoH in the router firmware itself. Find it under Advanced → Network → Internet → DNS over HTTPS. Enabling this encrypts the DNS queries your router makes to its upstream resolver, preventing your ISP from reading those requests even when no VPN is in use — a meaningful security improvement for any household.

DNSSEC validation: Quad9 validates DNSSEC by default, rejecting forged DNS responses from compromised upstream resolvers or man-in-the-middle attackers. This is separate from the leak problem — DNSSEC protects integrity, not confidentiality — but it matters if your DNS investigation started after a redirect or phishing incident rather than a VPN audit. The base specification is defined in RFC 4033.

IPv6-only ISPs: A growing number of ISPs in Asia-Pacific and parts of Europe are moving to IPv6-only access with NAT64/DNS64 for legacy IPv4 sites. On these connections, disabling IPv6 at the router breaks internet access entirely. Use Option B (custom IPv6 DNS servers) instead, and confirm your VPN provider tunnels IPv6 before counting on full leak protection.

Common Misdiagnoses

"My VPN app is broken." The VPN tunnel and the DNS path are independent. Confirm your exit IP with curl ifconfig.me — if it shows your VPN provider's IP, the tunnel is working. Then run a DNS leak test. Seeing ISP resolvers means DNS is escaping through a separate path, not that the VPN itself failed.

"I already set DNS on my router, so devices are covered." On older Archer firmware, the WAN DNS setting and the DHCP DNS setting are two separate fields. The WAN setting controls what the router queries upstream; the DHCP setting controls what the router tells clients to use. Fixing only one leaves the other still pointing at ISP resolvers.

"Incognito mode prevents this." It does not. Incognito mode affects browser storage only, not how DNS queries are routed at the OS or network layer. Your ISP sees the same DNS queries in incognito as in normal browsing.

"It must be DNS cache poisoning, not a leak." Cache poisoning redirects specific domains to fake IPs while returning a normal-looking DNS response. A DNS leak exposes your queries to your ISP but resolves correct IPs. Poisoning breaks specific sites; a leak exposes all your traffic without affecting resolution accuracy. The symptoms and fixes are entirely different.

Preventing DNS Leaks Long-Term

• Enable automatic firmware updates (Advanced → System → Firmware Upgrade → Auto Update). The DHCP-revert bugs present in older Archer models were resolved in 2023–2024 builds.
• After any major firmware upgrade, re-verify your DNS settings immediately. Some version jumps reset WAN DNS back to automatic without warning.
• Re-run dnsleaktest.com once a month, or immediately after any ISP change, router replacement, or VPN provider switch.
• Audit every new device you add to the network. Smart TVs, IoT devices, and Chromecast often use hardcoded resolvers (8.8.8.8 is common) and ignore DHCP DNS settings entirely — your router configuration will not reach them.
• If you use Mullvad, ProtonVPN, or ExpressVPN, enable their built-in DNS leak protection toggle. It instructs the OS to block any DNS traffic that does not exit through the VPN tunnel — a second layer on top of your router configuration, covering edge cases the router fix alone cannot catch.