If browsing becomes unreliable while a Windows VPN is connected, changing servers is not always the best first move. DNS—the system that translates a domain name into an IP address—can affect how quickly a site opens and whether its name resolves at all. A VPN may also use its own DNS settings, so changing the Windows adapter alone might have no effect while the tunnel is active. This guide shows how to identify which setting is in control, test a custom resolver carefully, and undo the change if it causes trouble.
Understand Where DNS Fits in a VPN Connection
When you enter a website address, Windows or an application asks a DNS resolver for the corresponding address. The resolver might be provided by your internet connection, configured in Windows, or selected by the VPN client. The request then follows a network route, which may or may not be the same route used for other traffic. These are related but separate parts of a connection: a successful DNS lookup does not prove that a website is reachable, and a working VPN tunnel does not prove that every DNS request is using the route you expect.
There are usually two places to look. The Windows network adapter has DNS settings for its connection, such as Wi-Fi or Ethernet. A VPN client can also specify DNS servers, apply its own routing rules, or direct DNS through the tunnel. Some clients intentionally take control of DNS while connected to reduce leaks or keep name resolution consistent with the selected route. In that case, a custom address entered in Windows may apply only when the VPN is disconnected.
Start by noting the symptom and when it appears. If sites fail to open both with and without the VPN, investigate the Windows adapter and the local network first. If the same sites work without the VPN but fail only after connecting, check the VPN client’s DNS and routing options before editing Windows. If a site opens by a saved bookmark but not by its name, DNS is a stronger possibility than a general loss of connectivity.
2
Places to check: Windows and the VPN client
1
Setting to change at a time
3
Checks: resolve, connect, restore
A custom resolver can help distinguish a name-resolution problem from an issue with a particular route, but it is not a universal speed upgrade. Resolver location, network policy, VPN design, and the destination all affect the result. Use an address documented by a resolver provider you trust, and read its privacy and encryption details. Avoid copying an address from an old forum post or combining several unrelated troubleshooting changes, because that makes the result harder to understand.
Check the Current Windows and VPN DNS Settings
Before changing anything, record the current configuration so you can put it back. Note whether the computer is connected over Wi-Fi or Ethernet, whether the problem occurs only with the VPN connected, and whether other devices on the same network can open the affected sites. This simple comparison helps separate a Windows-specific issue from a router, provider, or destination problem. Do not treat another device’s successful connection as proof that the VPN route on this PC is working correctly; the devices may use different resolvers and routes.
To inspect the Windows adapter, open Settings and go to Network & internet. Choose Wi-Fi or Ethernet, open the connected network’s properties, and look for DNS server assignment. The exact labels and layout can vary between Windows versions. You can also open the classic adapter list by pressing Windows + R, entering ncpa.cpl, and pressing Enter. Right-click the active adapter, choose Properties, select Internet Protocol Version 4 (TCP/IPv4), and open its properties. Check IPv6 separately if your network uses it; an IPv4 change does not automatically change IPv6 DNS.
Next, open the VPN client while it is connected and look for settings named DNS, name resolution, tunnel, routing, or leak protection. The exact options depend on the client. Some apps offer a specific DNS choice; others use the system resolver or set DNS automatically when the tunnel starts. Do not disable a protection feature just to make a test appear to work. If the client’s setting is unclear, consult its documentation or connection log before changing adapter properties.
Windows can show configured DNS addresses, but that alone does not reveal every policy a VPN client may apply. In a terminal, the command ipconfig /all lists network adapters and their DNS servers. Look for the active physical adapter and any VPN or tunnel adapter, and note which one appears when the tunnel is connected. Output may include local network details, so do not post it publicly without removing identifying information. A result showing an address on an adapter is useful context, not a guarantee that all application requests use that server.
Before testing a resolver, make sure only one relevant connection is active. Disconnect other VPN or proxy applications, including clients that may install virtual adapters or change system proxy settings. Running multiple network clients at once can make DNS behavior confusing: one app may set the resolver while another changes the route. If you use a rule-based client, check whether DNS has its own routing mode rather than assuming that the system proxy setting controls it.
- ✅ Record whether the failure happens with the VPN off, on, or both.
- ✅ Note the current adapter DNS choice before editing it.
- ✅ Check the VPN client’s DNS and tunnel options while connected.
- ❌ Do not change the router, adapter, VPN profile, and browser settings all at once.
Set a Custom DNS Resolver in Windows
Choose a resolver using its provider’s official documentation. Confirm whether the instructions cover IPv4, IPv6, or both, and whether they describe plain DNS or encrypted DNS. Do not assume that entering a DNS address in Windows automatically enables DNS over HTTPS or sends requests through the VPN. Those are separate behaviors, and their availability depends on Windows, the resolver, and the VPN client.
For the Settings method, open Network & internet, choose the active Wi-Fi or Ethernet connection, and find DNS server assignment. Select Edit, switch from automatic to manual assignment, and enter the resolver address in the relevant IPv4 or IPv6 fields. Save the change. The words and positions of these controls can differ by Windows release. If the connection stops resolving names, return to the same menu and restore automatic assignment or put back the values you recorded.
The classic adapter method is useful when you need to inspect a specific interface. Open ncpa.cpl, right-click the active Wi-Fi or Ethernet adapter, and select Properties. Choose Internet Protocol Version 4 (TCP/IPv4), open Properties, and select the option to use specified DNS server addresses. Enter only the values documented by your chosen resolver, then confirm the dialogs. If you also need to configure IPv6, open its properties separately and follow the provider’s IPv6 instructions. Leaving one protocol on automatic while setting the other manually can produce different behavior for different connections.
Make one change at a time. For example, test IPv4 first if the resolver’s documentation supports that choice and your network uses it; do not simultaneously replace IPv4 and IPv6 servers, change browser security settings, and switch VPN servers. After saving, reconnect the VPN if needed. A VPN client may refresh adapter settings when it connects, so a value visible while disconnected may be replaced during the active session.
If Windows offers an encrypted DNS option for the selected resolver, follow the provider’s documented server name and encryption requirements rather than guessing. A server address alone may not be enough to configure encrypted DNS. If the VPN client has a DNS-over-HTTPS option or its own resolver list, avoid enabling competing controls until you understand which one takes precedence. DNS encryption protects the DNS request on its route, but it does not by itself encrypt all traffic or guarantee that a request travels through the VPN.
For a managed work or school computer, check the organization’s instructions before changing DNS. Network policy, device management, security software, and internal hostnames may rely on the assigned resolver. A custom public resolver can prevent access to internal resources even when ordinary public websites still load. In that situation, restore the managed settings and ask the network administrator rather than repeatedly trying different addresses.
Keeping the change narrow makes results easier to interpret. If you need help with a client or subscription setup, VPNOY provides the service’s starting point; the key troubleshooting step remains to check which DNS setting is active on your own Windows connection.
Test Name Resolution and the VPN Route
Test in a consistent order. With the VPN connected, open a site that previously failed by typing its address directly rather than using a saved tab. Then test a different site you normally use. If both load, repeat the same checks after disconnecting the VPN. A change that helps only in one state may indicate that the VPN client is taking control of DNS or applying a different route, rather than proving that the new resolver is universally better.
You can also use Windows Command Prompt to check name resolution. Run nslookup example.com, replacing the sample name with a domain you are authorized to test. The response usually shows the DNS server used for that lookup and whether it returned an answer. Run the same command before and after the change, under the same VPN state. Interpret it as a diagnostic clue: browser secure-DNS settings, VPN interception, cached responses, and application-specific routing can make a browser behave differently from a command-line lookup.
If you have changed a setting but Windows appears to keep using an old result, clear the local DNS cache with ipconfig /flushdns in Command Prompt. Then retry the lookup. This clears cached records on the computer; it does not change the DNS server, repair a broken tunnel, or clear caches held by a browser or remote resolver. Close and reopen the affected application if it continues to reuse a connection or cached result.
Separate a DNS failure from a route failure. If a domain name does not resolve, but another known-working domain does, examine the resolver response and the VPN client’s DNS policy. If names resolve but pages time out, investigate the route, firewall, VPN connection, or destination instead of changing DNS repeatedly. If only one browser fails, check its own secure-DNS setting and extensions. If several applications fail only while the tunnel is active, review the VPN client’s logs and route mode.
Also check for a mismatch between IPv4 and IPv6 behavior. A device may use one protocol for a DNS request and another for a connection to the destination. If the provider documents both types, configure them consistently where appropriate and test again. If you cannot determine which protocol is in use, return to automatic settings and use the VPN client’s supported DNS controls rather than disabling IPv6 or installing additional network tools as a guess.
A reliable test is a comparison, not a single “connected” indicator. Check whether the same names resolve, whether the intended sites load, and whether the VPN client reports an active tunnel. Avoid judging success from a speed-test result alone: DNS may influence the start of a request, but transfer speed and stability also depend on the selected route, congestion, the destination, and other network conditions.
Restore Settings and Common Questions
If the custom resolver makes browsing worse, go back to the same interface you used to set it. In Windows Settings, change DNS server assignment back to automatic, or restore the values you recorded. In the classic adapter properties, select automatic DNS assignment for the relevant protocol, unless your network administrator has provided specific values. Then reconnect the VPN and test again. If the VPN client has its own DNS setting, restore that separately; changing the adapter does not necessarily undo the client’s configuration.
After restoring the settings, clear the local DNS cache with ipconfig /flushdns if old results still appear. If the problem persists, disconnect and reconnect the network or restart Windows only after saving your work. Do not reset every network component as a first response: broad resets can remove saved network details, interfere with managed configurations, or make it harder to identify the cause. When a workplace or school device is involved, follow its support procedure.
For repeatable troubleshooting, keep a short note of the adapter changed, whether IPv4 or IPv6 was involved, the VPN state during the test, and what happened before and after. Do not include passwords, subscription links, or unredacted connection logs. A concise record makes it easier to restore a known-good configuration and helps support staff understand the issue without exposing account information.
Should I change Windows DNS if the VPN is already connected?
Not automatically. First check the VPN client’s DNS options and active adapter behavior. The client may set or route DNS independently, so changing Windows settings may have no effect during the tunnel. Use the client’s documented control when it provides one, and avoid disabling DNS or leak-protection features just to force a test.
Will a custom DNS server make my VPN faster?
It may change how quickly a domain name is resolved, but it does not guarantee faster downloads, lower latency, or a more stable tunnel. Those depend on several parts of the network path. Compare the same websites and VPN state before and after the change, and keep the setting only if it resolves the specific problem without creating another one.
Why does my browser work differently from other Windows apps?
A browser may have its own secure-DNS setting, cached results, extensions, or connection reuse. That can make it behave differently from nslookup or another application. Check the browser’s DNS settings and repeat the test with a fresh request. Do not assume a Windows adapter change controls every application’s resolver choice.
How do I undo a custom DNS change?
Return to the same Windows adapter or Settings page and restore automatic DNS assignment, or enter the original values you recorded. Restore any separate DNS option in the VPN client as well, reconnect, and test again. If the device is managed, use the organization’s approved settings rather than substituting public resolver addresses.