Why Does My VPN Leak DNS on Ship WiFi? 3-Step Fix

Updated 8 November 2026 · vpn, ship-wifi, dns-leak, privacy

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

If you're asking why your VPN leaks DNS on ship WiFi and how to fix it, the short answer is the connection order. Your phone or laptop picks up the ship's DNS server before the tunnel comes up, and it keeps using it. The fix: log into the ship's captive portal first, then connect the VPN with DNS-leak protection and the kill switch on, then run a leak test.

That covers most cases. The rest of this guide explains why the leak happens on ship networks in particular, what to do when the portal only works with the VPN off, and how to check that the fix still holds after the WiFi drops at two in the morning.

Why does my VPN leak DNS on ship WiFi?

Your VPN leaks DNS on ship WiFi because your device sends domain lookups to the ship network's own resolver when they should go only through the tunnel. Every time you type an address, your device asks a DNS server to turn the name into a number. When that question goes to the ship's server, the local network gets a list of every site and service you contact, even though the content itself stays encrypted.

Ship networks make this more likely than a home network does, for three separate reasons.

The captive portal takes over DNS first

A captive portal is the login page you see when you first join crew WiFi. To push you onto that page, the network intercepts your traffic before you authenticate, and DNS is usually the first thing it grabs. Your device accepts the ship's DNS server as part of joining the network.

If you start the VPN while the portal is still holding things up, the tunnel can come up half-built. Some apps then fall back to the DNS server the network handed out. The guidance in the research for this piece agrees on one point: finish the portal login before you enable the VPN.

The ship router answers DNS itself

Some routers intercept DNS queries and answer them locally, according to a WiFi troubleshooting guide published by 404vpn and updated in autumn 2026. On a ship this matters because the router between your cabin and the satellite terminal is often set up to manage a small, expensive link. If it catches DNS on its way out and replies itself, it can break or bypass the VPN's own DNS handling.

You usually can't change that router. Crew rarely get admin access, a problem covered in our guide to setting up a VPN on a ship's router without admin access. So the fix has to happen on your own device.

The gaps your VPN leaves open

Even with a clean connection order, a few settings let lookups slip past the tunnel:

1. Split tunneling sends excluded apps or traffic outside the VPN path, and their DNS lookups go with them.
2. IPv6 can carry requests outside a tunnel that only handles IPv4, unless the app blocks it.
3. WebRTC in browsers can expose network details if the VPN app has no protection for it.
4. Android Private DNS can override the resolver the VPN tries to set.

Each of these looks harmless on its own. Together they explain why a leak test can fail even when the VPN icon says you're connected.

How to fix a DNS leak on ship WiFi in three steps

The reliable fix is three steps done in the same order every time. The order matters more than any single setting.

1. Join the ship WiFi and complete the captive portal login. Make sure a normal web page loads before you touch the VPN. If the portal asks you to accept terms or enter a voucher code, do that first.
2. Connect the VPN with DNS-leak protection and the kill switch switched on. Check both settings in the app before you connect. DNS-leak protection is meant to keep DNS requests inside the tunnel and away from the local network. The kill switch blocks traffic outside the tunnel during Wi‑Fi handoffs, sleep or portal transitions.
3. Run a DNS leak test. The resolver it shows should belong to your VPN provider. If it shows the ship's resolver or the satellite provider, you still have a leak.

Then repeat the test after the moments that break things on a ship: the WiFi reconnecting, the laptop waking from sleep, moving to a different access point on another deck, and the tunnel dropping during a satellite handover. Sources on this topic name those exact events as the ones to retest after.

If you haven't set up a kill switch yet, the site's free VPN kill switch checklist for phones at sea covers both Android and iPhone.

When the portal only works with the VPN off

This is the case most guides skip. The portal loads only with the VPN off, so you log in, turn the VPN on, and later the WiFi drops. Now the portal wants you again, the kill switch blocks the login page, and you're stuck. Or you turn the kill switch off to get through, and your DNS leaks from then on.

Here is a decision path that works with the tools you control.

Step one: treat every reconnect as a fresh login

When the WiFi drops and the portal comes back, disconnect the VPN completely. Log into the portal again, confirm a page loads, then reconnect the VPN and run the leak test again. One source in the research says to authenticate first and then reconnect. Another notes that some VPN providers can let portal traffic through while the tunnel is up. Which one applies depends on your provider and the ship's network, so test it once on your own setup instead of assuming.

Step two: if the tunnel will not come back, change the protocol

If the VPN refuses to reconnect after the portal, the network may be blocking your protocol. The 404vpn guide, updated in autumn 2026, suggests trying OpenVPN over TCP on port 443, because that traffic looks like ordinary secure web browsing. It also lists VLESS as another protocol to try. Neither one guarantees leak protection by itself. Run the DNS test again after you switch. For why protocol choice matters on a satellite link, see our breakdown of WireGuard vs OpenVPN on high latency connections.

Step three: if it connects but keeps failing, lower the MTU

The same guide suggests lowering the MTU to 1280 in some WiFi failure cases. MTU is the largest packet your device sends. Ship networks add their own overhead, and oversized packets get dropped without any error message, which looks like a tunnel that connects and then goes quiet. Most VPN apps hide this setting in an advanced menu, so check yours before you sail.

Step four: on Android, sort out Private DNS

The 404vpn guide recommends checking Android's Private DNS setting while the VPN is connected. You can turn it off or set it to the hostname your VPN provider gives you. A Private DNS server picked months ago at home can conflict with the VPN's resolver on a ship network.

Step five: audit split tunneling

Open the split tunneling list and look at what is excluded. Banking apps and streaming apps often end up there to get around blocks or speed problems, and every excluded app does its DNS lookups on the ship's network. Decide app by app whether that trade is acceptable.

Which VPN leak protections matter: a comparison

Leak protection differs between VPN apps, and the differences match the gaps described above. The table below summarises a DNS leak protection comparison published by DNS Leak Checker, which says its results were updated on July 18, 2026. Nobody at this site has run these apps on a ship for this article, so treat every cell as that publisher's word.

The same comparison, updated July 18, 2026, lists monthly prices of $3.39 for NordVPN, $6.67 for ExpressVPN, $2.49 for Surfshark and $4.99 for Proton VPN. It doesn't say whether those are introductory rates, renewal rates or matching plan tiers, so check the official pages before you rely on any of them. A separate SafeWise listing from 2026 puts NordVPN at $11.99 a month or $99.48 a year with six simultaneous connections. The gap between those figures shows why you should re-check the price yourself on the day you buy.

Two other reviews add some detail. A Gizmodo review of NordVPN reported no IP, DNS or WebRTC leak in its test. A Gizmodo review of Bitdefender Premium VPN says it keeps your real IP and DNS requests inside the tunnel when you switch servers. Neither one tested on a ship network.

If you're choosing a provider with this problem in mind, NordVPN and Surfshark are the two in that comparison listed with all four protections. Those are sponsored links. None of the cited material proves how either app behaves on your ship's network, so the leak test after each reconnect still decides. For a wider comparison of providers, see our guide to the best VPN for cruise ship crew.

Pros and cons of the portal-first fix

The portal-first routine is the best general fix available, and it has real limits.

Pros:

1. It costs nothing. The fix is an order of operations plus a few settings you already have.
2. It works on any VPN app that offers DNS-leak protection and a kill switch.
3. It gives you a way to check. A leak test shows within a minute whether the fix held.

Cons:

1. It has to be repeated. Every portal timeout, sleep cycle or dropped tunnel means logging in again and testing again, and on some ships that happens many times a day.
2. The kill switch can lock you out. When the portal comes back while the kill switch is on, you lose all connectivity until you disconnect the VPN by hand.
3. A test only shows the moment you ran it. It can't tell you whether a brief leak happened before you tested, or during the seconds between portal login and tunnel start.
4. Protocol and MTU changes cost speed. TCP-based tunnels over a satellite link are often slower, a trade-off explained in our piece on why a VPN makes slow ship internet slower.

Who should not rely on this fix alone

This routine protects ordinary privacy on shared WiFi. It isn't enough for some readers.

If your employer or a client contract requires VPN use, ask for their own setup and follow it. A client's managed VPN may handle DNS differently, and changing its settings can break their compliance rules. If your cruise line or shipping company restricts VPN use, check the crew policy before you do any of this. Nothing in the research for this piece establishes what any particular operator permits.

If your worry is what the ship's IT team can see, fixing DNS is only part of the answer. Our article on whether your ship's IT department can see through a VPN covers the rest. If the VPN won't stay connected at all, start with why the VPN keeps disconnecting on ship WiFi, because a tunnel that keeps dropping can't hold a leak fix.

FAQ

Is a DNS leak on ship WiFi dangerous?

A DNS leak shows the names of the sites and services you contact to whoever runs the resolver, even though the content of your traffic stays encrypted. When a leak test shows the ship's resolver or its internet provider, the local network may be receiving that metadata. What a particular ship logs or keeps isn't public, so assume the lookups can be seen.

Can the ship see my DNS lookups if my VPN is connected?

The ship can see your DNS lookups only if they leave your device outside the tunnel. With DNS-leak protection on and a clean leak test, lookups should go to your VPN provider's resolver. Run the test again after every reconnect, because a dropped tunnel can bring back the ship's resolver without warning.

Should I turn off Private DNS on Android at sea?

A WiFi troubleshooting guide published by 404vpn and updated in autumn 2026 recommends either turning Private DNS off or setting it to your VPN provider's hostname while connected. Either choice stops a separate DNS setting from fighting the VPN. Run a leak test afterwards to confirm.

Does a kill switch stop DNS leaks?

A kill switch blocks traffic outside the tunnel during WiFi handoffs, sleep or portal transitions, which closes the window where lookups would otherwise escape. It doesn't replace DNS-leak protection, which keeps lookups inside the tunnel while it is up. Turn both on.

Do I have to reconnect the VPN after every portal login?

On most ship networks, yes. Disconnect the VPN, log into the portal, confirm a page loads, then reconnect. Some VPN providers can let portal traffic through while connected, so test that once on your own setup before you skip the step.

Verdict

DNS leaks on ship WiFi mostly come down to timing: the captive portal and the ship's router get to your DNS before the tunnel does. Log into the ship's captive portal first, then connect the VPN with DNS-leak protection and the kill switch on, and test again after every reconnect. When the portal fights the VPN, reconnect cleanly, then try a different protocol, a lower MTU, the Android Private DNS setting and your split tunneling list, in that order.

Related reading

• Why port WiFi captive portals block your VPN connection
• Port WiFi security and how to avoid getting hacked
• How seafarers stay connected at sea, and what it costs

About the author

This guide was written by a working marine engineer who relies on shared crew WiFi during contracts and knows how captive portals, satellite handovers and locked ship routers behave from the cabin side. No VPN app was lab-tested for this article. Every product detail above comes from the third-party reviews listed in the claims section, and each one is labelled as their word. The goal is to answer one question for crew and remote workers at sea: why does my VPN leak DNS on ship WiFi, and how do I fix it.

Latest updates

• How to Set Up a VPN Kill Switch on a Phone at Sea: 15 Steps — our newest guide on this topic.