Definition
The Domain Name System is the hierarchical, distributed naming system that allows humans to use memorable names instead of numerical IP addresses. When you type 'example.com' into a browser, your device first asks a DNS resolver for the corresponding IP address, and only then can it open a connection. DNS is one of the oldest still-running systems on the internet, dating to 1983, and is involved in essentially every interaction you have online.
Why DNS Is a Privacy Concern
DNS queries are themselves a record of every site you visit. Traditionally they are sent in the clear over UDP port 53, which means your ISP, your Wi-Fi operator, and any network observer between you and the resolver can see the full list of domains you look up — even if the actual page content is encrypted with HTTPS. This is the so-called DNS metadata problem, and it is one of the main reasons VPN users care about DNS handling.
DNS in a VPN
A correctly configured VPN routes DNS queries through the encrypted tunnel and resolves them through the VPN provider's resolver, not the local ISP's. This prevents both the ISP from seeing queries and a local network from logging them. A misconfigured VPN, however, may suffer a DNS leak — sending queries outside the tunnel even while the rest of the traffic is protected. Modern protocols like DoH and DoT add a second layer of protection by encrypting DNS queries themselves.