Best VPNs with private DNS

Your DNS requests are just as important – and can be just as revealing – as your browsing history. In fact, they’re pretty much tied together. So it’s critical for a VPN provider to also ensure your DNS traffic is protected. Some VPNs even provide you with privacy features via DNS, such as ad and malware blocking.

This post looks at the best VPNs with private DNS to help you choose the one best suited for your needs. If you’re in a rush and don’t have time to read the whole thing, here’s a summary of our top picks:

1. NordVPN: The best private DNS VPN. With support for OpenVPN, WireGuard, and IKEv2, it’s hard to go wrong with NordVPN. No logs, fast speeds, excellent security, private in-tunnel DNS servers with ad and malware blocking. Includes a risk-free 30-day money-back guarantee.
2. Surfshark: Excellent support, great speeds, a vast VPN network, private DNS (with ad and malware blocking), and low prices are just some of the features that grant Surfshark a top spot.
3. ExpressVPN: ExpressVPN provides access to over 3,000 servers in more than 94 countries. High-speed connections to secured VPN servers with private in-tunnel DNS and strong encryption.
4. CyberGhost: CyberGhost provides fantastic speeds, has a strict no-logs policy, and its in-tunnel DNS servers include an ads and tracker blocker, available in all its apps.
5. IPVanish: iVPN is a fantastic choice for security-minded users with its excellent privacy policy, robust encryption, private in-tunnel DNS servers which support ad and malware blocking, and unlimited simultaneous connections.

Below you’ll find the criteria we used to choose the best VPNs with private DNS:

• The VPN should not log any identifying information about its users and their use of the service
• Should provide their no-logging DNS servers in-tunnel by default.
• DNS leak protection
• Robust and up-to-date encryption standards
• Easy-to-use and well-designed apps
• Fast, reliable connection speeds
• Decent-sized server network
• Torrenting support
• Streaming support (Netflix, Amazon Prime Video, etc.)

The best VPNs with private DNS

Here is our list of the best VPNs with private DNS:

1. NordVPN

Apr 2024

NordVPN takes the top spot here. This Panama-based provider keeps no traffic logs, and its jurisdiction has no mandatory data retention laws. It supports three secure VPN protocols (OpenVPN, NordLynx, and IKEv2). And all three protocols are available over its 5600 servers in 60 countries.

NordVPN’s privacy and security practices are some of the best in the industry (arguably the best). It adheres to a robust no-logging policy and doesn’t collect any information on your online activities or how you interact with its service.

By default, when connected to one of its VPN servers, its no-logging, in-tunnel DNS servers are used. And you can enable ad and malware blocking (recommended). NordVPN uses modern and robust encryption and wasn’t vulnerable to either IP, DNS, or WebRTC leaks in our testing. And a kill switch is included in all of its apps, which blocks all traffic from your device if the VPN unexpectedly disconnects.

NordVPN also bundles a smart DNS service in its subscriptions. Smart DNS is distinct from the VPN service and does not tunnel or encrypt your traffic. It is simply a DNS service that enables you to bypass geo-restrictions for supported streaming services by proxying the connection before accessing the service. You can find more information about the service in NordVPN’s support pages.

Regarding speed, NordVPN is one of the fastest VPN providers we tested. That bandwidth will come in handy for torrenting and streaming (4K/8K), which NordVPN supports extremely well.

NordVPN provides native clients for Windows, macOS, Linux, Android, iOS, and Amazon FireTV. It also supports NAS devices and routers.

BEST PRIVATE DNS VPN:NordVPN is our top choice. It only supports secure VPN protocols and doesn’t collect user logs. Its speeds are excellent. It provides no-logging, in-tunnel DNS servers on all connections by default, and its DNS servers support ads and tracker blocking. NordVPN provides a 30-day money-back guarantee, so you can try it risk-free.

Read our full NordVPN review.

---

2. Surfshark

Surfshark is another great VPN provider with excellent “DNS hygiene.” Surfshark may not be a household name like NordVPN or ExpressVPN, but this VPN provider, based in the Netherlands, is nonetheless impressive.

The Netherlands may not have mandatory data retention laws, but it’s still part of the Nine Eyes – which can be off-putting for some. But you can’t share what you don’t have, right? Surfshark’s strict no-logging policy and excellent privacy policy make it clear that it would have nothing to supply if law enforcement came knocking.

Surfshark supports OpenVPN, WireGuard, and IPsec – all very secure protocols. It uses 256-bit AES encryption with a SHA512 authentication hash and a 2048-bit DHE-RSA key exchange that supports perfect forward secrecy (PFS). It provides private, in-tunnel DNS servers on all connections by default. And users can enable its DNS-based ad and malware blocker. Surfshark wasn’t vulnerable to IP, DNS, or WebRTC leaks in our tests. And all of its apps include a kill switch.

Surfshark also provides a smart DNS service with its subscriptions. As with NordVPN, this is a service to circumvent georestrictions and does not provide the same level of privacy or security as a VPN. It simply proxies your requests to streaming sites.

Other perks are Surfshark’s excellent streaming support and the fact that it works from China. The service also allows for unlimited simultaneous connections, and its prices are great. Surfshark provides Windows, macOS, Linux, iOS, Android, and Amazon FireTV apps.

BEST VALUE VPN:Surfshark's secure VPN provides a massive network of 3,000+ servers at low prices. Surfshark gives you fast speeds, secure DNS servers that support ad and malware blocking, and works from China. It also supports unlimited simultaneous connections. All its subscriptions come with a 30-day money-back guarantee.

Read our full Surfshark review.

---

3. ExpressVPN

ExpressVPN is another fantastic VPN provider that often sits in our top spots. While the service is based in the British Virgin Islands, it is not part of the UK, despite what many believe.

ExpressVPN supports three VPN protocols, which are all very secure: OpenVPN, Lightway, and IKEv2. Lightway is ExpressVPN’s custom VPN protocol, which is open source (and can be audited). All three protocols are supported across its network of over 3000 VPN servers. And its client apps are very intuitive and easy to use.

ExpressVPN has very high security standards. It uses AES-256 encryption, 4096-bit RSA keys, and SHA256 authentication while supporting perfect forward secrecy (PFS). All of ExpressVPN’s servers run from volatile memory (RAM), guaranteeing that no remnant data (logs) can exist on the system’s hard drives.

Regarding its DNS practices, as you’d guess, it provides its secured, no-logging DNS servers on all connections by default. Unfortunately, at this time, ExpressVPN does not offer DNS-based ad and malware blocking. Hopefully, this will come in a future update. A kill switch is provided in all of its apps, so sudden VPN disconnects won’t affect your privacy. In our testing, ExpressVPN was invulnerable to IP, DNS, or WebRTC leaks.

ExpressVPN also has its smart DNS service (called MediaStreamer) bundled with its subscriptions. And while it works very well, as with the above providers, smart DNS neither tunnels or encrypts your traffic.

ExpressVPN also provides excellent speed, and its streaming support is one of the best in the commercial VPN space. It provides native apps for Windows, macOS, Linux, iOS, Android, and some routers.

EASY-TO-USE:ExpressVPN's vast network provides you with over 3,000 servers in more than 94 countries. You get high-speed connections to highly secure VPN servers using secured in-tunnel DNS servers and robust and modern encryption. ExpressVPN provides you with easy-to-use apps and comes with a 30-day money-back guarantee.

Read our complete ExpressVPN review.

---

4. CyberGhost

CyberGhost is another one of our top VPNs with private DNS, providing users with fantastic speeds across its vast server network. CyberGhost is one of the fastest we tested. It boasts excellent torrenting and streaming support as well.

While CyberGhost was recently purchased by an Israeli company based in the UK, it will nonetheless remain an independent company based in Romania. Remaining Romania-based, along with CyberGhost’s strong privacy policy and robust no-logging policy, should put your mind at ease that your data is safe from British law enforcement.

CyberGhost only supports the three most secure VPN protocols: OpenVPN, WireGuard, and IKEv2. The provider uses AES-256-bit encryption and 2048-bit keys with SHA256 authentication while supporting perfect forward secrecy (PFS) for OpenVPN and IKEv2. WireGuard uses ChaCha20-Poly1305 encryption, which is also deemed highly secure.

Where DNS is concerned, CyberGhost supplies the obligatory secured, in-tunnel DNS server by default. And it also supports DNS-based ad and malware blocking in all of its apps (which also all include a kill switch). CyberGhosts did not suffer from IP, DNS, or WebRTC leaks in our testing. It also bundles a smart DNS service with its subscriptions and works as described above.

CyberGhost provides apps for Windows, macOS, Linux (CLI), iOS, and Android. Manual connections can also be configured on supported routers.

SPEEDY VPN:CyberGhost is another great VPN provider with private DNS. It provides excellent speeds, has a strict no-logging policy, and includes a DNS-based ads and tracker blocker. Torrenting and streaming are well supported, and a 45-day money-back guarantee backs all subscriptions.

Read our full CyberGhost review.

---

6. IPVanish

IPVanish‘s privacy policy is excellent, explicitly listing what it commits to not collecting and clearly disclosing what it does collect. That is aggregated and anonymous performance data for troubleshooting and optimization purposes—as little user data as possible. And the privacy policy is clear and easy to understand.

IPVanish supports several secure VPN protocols: OpenVPN, WireGuard, L2TP/IPsec, IKEv2, or SSTP (Windows-only).

And it secures those connections with AES-256-bit encryption, SHA512 authentication, and DHE-RSA 2048 key exchange that supports perfect forward secrecy (PFS) for OpenVPN, IKEv2, L2TP/IPsec, and SSTP. And it uses the more modern ChaCha20-Poly1305 ciphers for WireGuard.

It provides its secured in-tunnel DNS servers by default which also support ad and malware blocking (but no smart DNS service). When we tested the service, IPVanish provided excellent speeds and wasn’t vulnerable to DNS, IPv6, or WebRTC leaks.

IPVanish allows for unlimited simultaneous connections and provides native apps for Windows, macOS, iOS, Android, ChromeOS, and Amazon Fire TV. Linux is supported too, but only with a manual configuration.

GREAT SECURITY:IPVanish adheres to an excellent privacy policy, secures its connections with solid encryption, and still manages to get above-average speeds. With its support for unlimited simultaneous connections, you can connect as many devices as you want. The service also offers a 30-day money-back guarantee on all subscriptions.

Read our full IPVanish review.

---

How to connect to a VPN with private DNS?

Using a VPN with private DNS doesn’t require any special instructions, as your DNS queries are routed to the provider’s secure, in-tunnel DNS servers by default. So your typical connection instructions will apply here as well:

1. If you haven’t already done so, sign up for one of the VPN providers above. NordVPN is our top recommended choice.
2. Download the provider’s app for your device.
3. Refer to your provider’s setup instructions. It should be as simple as choosing a server and tapping a “Connect” button. Your VPN provider can help you with any issues you might encounter.
4. That’s it. The VPN app remains connected in the background.

Methodology used for VPN testing

Below you’ll find the criteria used to assess the VPNs we review. It’s essential to be consistent across the board so that our reviews are reasonably objective and that we’re not comparing apples to oranges. For that reason, we disclose our criteria.

• Private DNS – The providers listed must supply their in-house, no-logging, in-tunnel DNS servers by default to make sure that your DNS queries are rerouted through the tunnel and that you aren’t leaking your DNS requests (or anything at all, for that matter).
• Speed – Speed is one of the most crucial factors for any VPN. Aside from being annoying, slow speeds can prevent you from streaming or browsing the web. Our recommended VPNs scored very high in our most recent speed tests to ensure we address this issue.
• Servers worldwide – Access to various geographical regions is essential to VPN users. It helps when you want to bypass geo-restrictions. And it makes it easier to find a server close to your actual location to maximize your speed.
• Multiple protocols – You want a provider that supports multiple secure VPN protocols because, in certain situations, one may be more beneficial than another. OpenVPN, for example, can use TCP, which can help to bypass restrictive firewalls in some cases. So having a good choice of protocols is essential. The majority of our recommended VPNs support IKEv2, OpenVPN, and WireGuard.
• Ease-of-use – The VPN needs to be easy to use and accessible to all, whether they’re tech-savvy or not. We ensure our recommended providers provide simple and straightforward apps so you can be up and running in minutes.
• Streaming services – Accessing streaming sites over a VPN is more challenging than ever. Many VPN providers claim to work on streaming sites, but their success rates can vary. Before recommending a VPN provider for streaming, we test VPNs against various popular streaming services, including Netflix, Amazon Prime Video, BBC iPlayer, HBO Max, Disney+, Hulu, etc.
• Torrenting – Many VPN users are avid file-sharers, but not all VPN providers allow torrenting over their network. Others provide dedicated P2P servers. We look at each VPN’s policy around torrenting – ensuring it’s supported – and run tests on those to see how well they handle file-sharing.
• Security & privacy – That’s why VPNs exist in the first place. We ask essential questions like: What is the provider’s privacy policy like? What is its logging policy? What encryption protocols does the VPN support? Does it use strong ciphers? Does it support Perfect Forward Secrecy (PFS)? Is it vulnerable to IP address or DNS leaks? These are all crucial questions, and we answer them all when assessing VPNs’ privacy and security practices.

The above represents a high-level view of our methodology. For more details, look at our full VPN testing methodology. This data-driven approach helps us better understand the services to recommend the right VPN to different users.

Private DNS VPNs FAQ