Detecting and Stopping Rogue DNS Leaks on a VPN with resolvectl and systemd‑resolved

 Posted on 18 October 2026  |  4 minutes  |  697 words  |  Carla Brown

Why DNS leaks matter

A VPN’s promise is simple: keep every packet, DNS included, inside the encrypted tunnel.
When a client still talks to the local resolver or the ISP’s DNS server, the very destination of that query is exposed. Even a single leak can give away browsing habits, slip past content filters, or make a user a target for a phishing or man‑in‑the‑middle attack. Detecting and stopping those leaks is a routine part of hardening any VPN‑based deployment.

Detecting leaks with resolvectl

resolvectl (part of systemd‑resolved) gives a quick snapshot of what DNS servers each interface is using. On a typical system:

$ resolvectl status
Global
          DNS Servers: 8.8.8.8
          DNSSEC NTA: 192.168.0.0/16
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNSSEC enabled: yes
          DNSSEC trust anchors: 8
          DNSSEC supported: yes
          DNS
linux  open-source 

See also