TL;DR
In-tunnel DNS routes all your domain name resolution requests exclusively through encrypted VPN tunnels to private, zero-log DNS resolvers operated directly by OllaVPN. This eliminates DNS leaks, prevents ISP surveillance, and protects your browsing history from being recorded or monetized.
Unlike weak VPNs that fall back to public DNS resolvers or leak queries at the OS level, OllaVPN enforces kernel-level firewall rules blocking port-53 leaks and pairs every DNS query with post-quantum WireGuard encryption across all platforms on the free tier.
KEY TAKEAWAYS
- • Zero DNS Leaks: DNS requests are resolved inside the encrypted tunnel, completely hiding website domain lookups from your ISP.
- • Operator-Controlled Resolvers: Runs on private Unbound DNS nodes with strict zero-logging and DNSSEC validation.
- • Firewall-Enforced Protection: OS-level firewall rules block all outbound port-53 queries outside the tunnel to prevent silent leaks.
- • 100% Free by Default: Included on every OllaVPN connection with no subscription fees, credit cards, or logs required.
What is in-tunnel DNS and why is it so important?
In-tunnel DNS ensures that every domain lookup your device makes is encrypted and routed exclusively through the VPN tunnel to private, zero-log resolvers, completely shielding your destination requests from your ISP.
When you type a website address into your browser, your computer first needs to look up that domain's IP address. Without in-tunnel DNS, those lookup requests (DNS queries) travel unencrypted across your local network directly to your internet service provider (ISP). Even if your subsequent website traffic is encrypted, your ISP still captures a complete record of every single domain you attempt to visit.
In-tunnel DNS closes this critical security gap by hijacking your device's DNS settings at the network stack level. All DNS packets are encrypted and transported inside the secure WireGuard tunnel to private resolvers operated exclusively by OllaVPN.
How does OllaVPN's in-tunnel DNS work, step-by-step?
OllaVPN intercepts your DNS requests on your device, encrypts them, and sends them through the secure VPN tunnel to our private, no-log DNS resolvers, which then fetch the IP addresses for the websites you want to visit.
When you connect to OllaVPN, our app takes over your device's DNS settings. This means that instead of sending your domain name requests (like "ollavpn.com") to your internet provider's DNS servers, all those requests are immediately redirected to OllaVPN. From the moment you hit "connect," every bit of traffic, including your DNS queries, travels through our encrypted tunnel, making it impossible for your ISP or anyone else to see what sites you're trying to reach.
Once inside the tunnel, your DNS queries are sent directly to OllaVPN's private DNS resolvers. These aren't just any public DNS servers; they're infrastructure we operate ourselves, specifically designed to uphold our strict no-logs policy. They don't keep records of your activity, ensuring your browsing habits remain private. Using our own resolvers, rather than relying on third parties, is a critical part of how we protect your privacy end-to-end. Your requests stay within our trusted network until the very last step.
After our resolvers look up the IP address for the website you're visiting, that information is sent back to your device, still protected within the secure tunnel. Only then does your device know where to send the actual request for the website's content. This whole process happens incredibly fast, thanks to the efficiency of the WireGuard protocol that OllaVPN uses.
What do other VPNs often get wrong with DNS, and how is OllaVPN different?
Many VPNs leave your DNS requests vulnerable to leaks or use third-party servers, while OllaVPN encrypts and routes all your DNS traffic directly through its own secure, private resolvers inside the VPN tunnel.
A lot of VPNs, especially ad-funded or freemium throttled providers, overlook DNS security or cut corners. Even if your web traffic is encrypted, your DNS queries might still go through your ISP or a public third-party resolver. This creates a severe privacy hole known as a DNS leak.
Some VPNs try to fix this by using publicly available DNS resolvers like Cloudflare or Google. While these are faster than ISP resolvers, they are still third parties that log and analyze connection telemetry. Furthermore, weak clients fail to enforce firewall rules, causing the operating system to fall back to unencrypted local DNS.
OllaVPN operates its own private, zero-log Unbound DNS resolvers co-located on every exit node. DNS requests are resolved entirely in-memory with zero disk logging, eliminating DNS hijacking and accidental leaks.
What real-world threats does in-tunnel DNS protect you against?
In-tunnel DNS protects your online activity from being snooped on by your internet provider, bypasses government or corporate content filters, and helps prevent you from landing on malicious websites.
When you type a website address into your browser, your computer needs to translate that into an IP address. Normally, your internet provider handles this translation, allowing them to build an exhaustive log of your daily habits, shopping, banking, and medical research.
ISP Data Harvesting Defense: Your ISP only observes encrypted WireGuard packets traveling to a single OllaVPN exit node, with zero visibility into individual hostnames or destinations.
DNS Filtering & Censorship Bypass: Bypasses restrictive ISP-level and state-sponsored DNS filters by resolving domain records through our uncensored international resolvers.
DNS Spoofing & Phishing Immunity: Eliminates rogue local Wi-Fi hotspot attacks where malicious routers return fake IP addresses for banking and login portals.
Are OllaVPN's DNS features on by default, and can you customize them?
Yes, OllaVPN's in-tunnel DNS is enabled by default across all platforms with zero configuration required, while offering custom resolver options for power users.
OllaVPN automatically enforces in-tunnel DNS the moment you connect. No manual IP entry, scripts, or network configuration is required. Our client configures the network stack and firewall silently in the background.
For advanced users requiring specialized upstream resolution (such as custom Pi-hole filters or internal corporate resolvers), OllaVPN provides full customization options inside the application settings, continuing to route those queries securely through the encrypted tunnel.
How can you verify that OllaVPN's in-tunnel DNS is working?
You can verify your DNS protection in less than five minutes using our built-in DNS lookup tool and independent leak tests.
We encourage every user to independently verify their DNS security rather than taking marketing claims on faith. Here is the exact verification procedure:
Step 1 — Baseline Test: Without OllaVPN connected, run our DNS lookup tool. Note your ISP's resolver IP address.
Step 2 — Connected Verification: Connect to OllaVPN and re-run the test. You will see an in-tunnel CGNAT address in the 100.64.0.0/10 range, proving resolution happens inside the tunnel.
Step 3 — Third-Party Leak Test: Visit an independent DNS leak test site while connected. Confirm that zero ISP resolvers or external IP addresses are visible.
What are the limitations of in-tunnel DNS, and what doesn't it solve?
In-tunnel DNS protects domain resolution and prevents ISP eavesdropping, but it does not stop browser fingerprinting, cookies, or phishing links you voluntarily click.
Understanding your threat model means understanding what each security layer does and does not accomplish:
What It Solves: Encrypts all DNS queries, stops ISP browsing logs, blocks rogue Wi-Fi spoofing, and bypasses DNS-based website blocking.
What It Does Not Solve: Application-level trackers, tracking cookies stored in your browser, social media account logins, or malware downloads.
How does in-tunnel DNS integrate with OllaVPN's other privacy features?
In-tunnel DNS works symbiotically with OllaVPN's default kill switch, post-quantum cryptography stack, and strict peer isolation.
Security primitives in OllaVPN are designed to operate as a cohesive, layered architecture:
Kill Switch Integration: If the VPN tunnel drops unexpectedly, the OS firewall instantly blocks all network traffic, preventing any unencrypted DNS packets from escaping.
Post-Quantum Cryptography: Our hybrid X25519 + ML-KEM-768 handshake protects the entire tunnel, including DNS queries, against future quantum decryption.
Peer Isolation: Prevents any device connected to the same VPN exit node from intercepting or snooping on your in-tunnel DNS requests.
Does in-tunnel DNS impact my connection speed or latency?
No. In-tunnel DNS runs directly on co-located exit node resolvers with sub-millisecond local caching, resulting in faster and more responsive domain lookups.
Because our Unbound resolvers are physically deployed directly on each VPN exit server, DNS resolution latency is nearly instantaneous. Hot domain lookups are cached directly in RAM, often returning responses faster than congested residential ISP resolvers.
Is OllaVPN's in-tunnel DNS future-proof against evolving threats?
Yes. In-tunnel DNS is hardened with DNSSEC cryptographic signature validation and protected by post-quantum encryption.
Our resolvers validate upstream DNSSEC cryptographic signatures from authoritative root servers, ensuring responses cannot be forged or tampered with. Combined with our post-quantum key exchange, your historical browsing metadata remains secure against future quantum decryptors.
Is in-tunnel DNS available on OllaVPN's free plan?
Yes. In-tunnel DNS, kill switch enforcement, and WireGuard tunneling are 100% free by default for all users.
We believe essential privacy is a fundamental human right, not a luxury feature to be paywalled. Every free plan user receives the exact same in-tunnel DNS security, no-logs protection, and encryption stack as our Plus subscribers.
How does OllaVPN's DNS posture compare to other free VPNs?
OllaVPN operates its own zero-log resolvers and enforces kernel-level firewall blocking on port 53, whereas competitors frequently leak queries or rely on third-party public resolvers.
Operator-Controlled vs Third-Party: OllaVPN operates dedicated, zero-log Unbound resolvers on every server. Competitors often route queries through third-party services like Google or Cloudflare.
Firewall-Enforced vs Advisory Routing: OllaVPN installs kernel firewall rules (Windows Filtering Platform / macOS Packet Filter / Android VpnService) to block all non-tunnel port-53 queries. Weak VPNs allow the OS to silently fall back to ISP DNS.
What our DNS layer deliberately doesn't ship
To maintain maximum stability and privacy, here is what our DNS architecture deliberately avoids:
No Public Resolver Fallback: We never silently fall back to Google (8.8.8.8) or Cloudflare (1.1.1.1) if a lookup stalls; if the tunnel resolver is unreachable, the kill switch safely halts traffic rather than leaking data.
No Commercial Telemetry: Our resolvers run with query logging disabled in source code, with zero analytics, marketing tracking, or telemetry collection.
No Aggressive False-Positive Blocklists: We avoid unvetted DNS ad-blocking lists that break legitimate websites without user consent, favoring client-side browser extensions like uBlock Origin.
Frequently Asked Questions
Wrapping It Up
In-tunnel DNS is a fundamental cornerstone of genuine internet privacy. Without it, standard VPN encryption leaves your browsing destinations completely exposed to your ISP and local network operators.
With OllaVPN, you get operator-controlled zero-log Unbound resolvers, kernel firewall-enforced port-53 blocking, and post-quantum WireGuard encryption built-in by default on all platforms.
Want this on your device?
OllaVPN is free forever for 1 device. No card, no email tricks.
Get OllaVPN free →