Short answer: A DNS result that looks different just after disconnecting a VPN can come from cached answers, a changed DNS resolver, or both. A cache entry is a saved answer with a limited lifetime; it does not show which resolver will handle the next lookup. A changed result by itself is not evidence of a DNS leak.

Why DNS can look different after disconnect

When an app looks up a domain, the device may first reuse a locally cached answer. If it needs a new answer, it sends a query to a resolver. Recursive resolvers also cache answers, so a fresh device query may still be answered from the resolver's cache. ICANN describes resolvers as systems that resolve names for clients and notes that they typically cache results.

A VPN can change the DNS server or route used for covered requests while it is connected. After disconnect, the operating system or VPN app may restore the network's configured DNS settings. Existing answers can remain in a device or browser cache until they expire, and a resolver can have its own separate cached copy. Those layers can make a site open at an old address, a new address, or fail temporarily. The exact behavior depends on the operating system, browser, VPN app, and network.

DNS records have a time-to-live (TTL) that limits how long a cached answer may be reused. The client cache and recursive resolver cache are separate: clearing one does not clear the other, and flushing the device cache does not reveal or erase what a DNS provider has cached.

Check first, without changing settings

1. Note the device, browser, VPN app, network, time, and whether the VPN is connected. Keep the network and browser the same while comparing results.
2. Check the VPN app's current documentation for how it handles DNS while connected and when disconnected. Do not assume every provider restores DNS in the same way.
3. On Windows, open Command Prompt and run ipconfig /displaydns to view the Windows DNS client resolver cache. Microsoft notes that this includes locally loaded Hosts-file entries as well as recently obtained records. A cached entry is not a record of every DNS query or a history of which resolver answered it.
4. If you use a browser's Secure DNS or DNS-over-HTTPS setting, note its state too. The browser may use a resolver path different from the operating system's default; see DNS over HTTPS and VPN routing.

When a local cache flush may help

If a domain still resolves to an outdated answer or fails after the VPN is disconnected, Windows has a built-in way to clear its local DNS client cache. In Command Prompt, run ipconfig /flushdns, then retry the same domain. Microsoft documents that this flushes and resets the DNS client resolver cache, including negative entries. It does not change VPN settings, network DNS configuration, browser caches, or a recursive resolver's cache. The next lookup may need to request an answer again.

Flushing is a troubleshooting step, not a privacy test. A result that changes afterward only shows that clearing the local cache affected the lookup path; it does not identify the resolver, establish whether a query was exposed, or prove that every app used the same route. If this is a managed device, follow your administrator's process before running commands or changing network settings.

How to investigate an unexpected result

• Reconnect and disconnect the VPN once while keeping the same network, then retry the same site. Avoid changing several DNS or VPN settings at once.
• Check the VPN provider's documented DNS behavior and the operating system's current DNS configuration. A resolver name or location shown by a test is an observation to investigate, not proof that a provider or ISP handled every query.
• If the issue persists, compare with the DNS test guide and its limits. A browser test observes its own lookups at that time; it cannot audit every application or determine cache contents on remote resolvers.
• For Windows DNS-resolution failures, use Microsoft's troubleshooting steps or contact the VPN provider or network administrator with the time, network, and exact error. Avoid sharing screenshots that expose public IP or private network details.

This guide covers the Windows cache commands documented by Microsoft. Other systems and browsers have different cache controls, so use the current documentation for that platform. For Android's Private DNS setting, see Android Private DNS and VPN DNS. This site does not inspect your device or run a DNS test.

Impact — TODO: apply/approval and configure referral URL — referral link not configured.

PartnerStack — TODO: apply/approval and configure referral URL — referral link not configured.

CJ Affiliate — TODO: apply/approval and configure referral URL — referral link not configured.