A Lvcha VPN DNS leak means the tunnel is up and pages load, but name queries still land on the ISP or the router. Connect, open https://1.1.1.1/help, and read the DNS fields. If they still name the broadband provider, enable Use VPN DNS / leak protection, drop manual DNS and Android Private DNS, then flush the cache. This is not the same checklist as “the web is dead.”
Leaks change geo-targeting, campus filters, and which resolver sees internal names. They rarely look like timeouts—those go to no traffic. Cloudflare’s primer is What is DNS. Builds: download page.
One test you can quote later
Connect Lvcha, force global (no split), use the system browser on 1.1.1.1/help. Write down: did the egress IP change, and who owns DNS. Egress changed + ISP DNS = leak. Egress unchanged = you do not have a tunnel yet, so stop toggling leak switches.
A second probe: ping 1.1.1.1 works, hostnames fail → broken resolution, which may or may not be a leak. A leak more often looks like “everything loads, every streaming homepage is still my living room.” Keep both results on one note line.
| Result | Meaning | Next |
|---|---|---|
| Egress moved, DNS still ISP | Leak | VPN DNS on, manual DNS off |
| Egress unchanged | Traffic not in tunnel | Permissions, leftover proxy, split |
| IP pings, names fail | Resolution failure | Flush, swap VPN DNS |
| One app’s region is wrong | App-level DoH or cache | Clear that app, do not reinstall Lvcha |
Windows, Android, and iOS leak from different knobs
Windows: Settings → Network → DNS still holding 8.8.8.8 or a campus NRPT leftover. Without Use VPN DNS, queries keep asking those servers. Run ipconfig /flushdns after the change. Disable orphan virtual NICs from old accelerators so DNS is not bound to a zombie adapter. Microsoft’s resolver notes live under DNS client resolver.
Android 9+ Private DNS (DoT) races the VPN. Set it Off for a leak test. If you must keep Private DNS day to day, pick a host you actually trust and live with the test page naming that host—not Lvcha. OEM “encrypted DNS” labels differ; search the Settings box for DNS instead of hunting the battery page. Split-app mode that leaves the system resolver on Direct will also leak; see split tunnel.
iOS stores DNS on the VPN payload. A leftover “encrypted DNS” profile or MDM DNS wins. Settings → General → VPN & Device Management should show Lvcha only. iCloud Private Relay muddies the test; disable it for one measurement. Profiles and first-run permission: install guide.
Routers, IPv6, and split rules that send queries home
DHCP that points DNS at the gateway will expose anything that never entered the tunnel. Cellular as a control: leak on home Wi-Fi, clean on LTE, means the router (or its ISP forwarders). Do not stack a third “DNS booster” app on the PC—three resolvers cannot be attributed.
IPv6 up, tunnel IPv4-only: AAAA queries and v6 sockets skip Lvcha. The v4 egress changes; v6 is still the ISP. Continue in IPv6 bypass instead of toggling leak protection ten times.
Smart split that marks domestic names Direct will also Direct their DNS. That is intended if you wanted local sites local. If the goal is “every lookup in the tunnel,” the leak test must run in global mode, then you add exceptions back one at a time. Corporate DNS interception beats a client toggle; switch to the office network article.
When the test page still names the ISP
Global + VPN DNS + Private DNS off + flush, and it still leaks: look for a second accelerator, Chrome/Edge “use secure DNS,” or a TLS-inspecting office gateway. Disable the browser DoH checkbox before you uninstall Lvcha.
Do not ritual-test every morning. Retest after a ROM flash, a new SSID, or a major OS upgrade. Walkthroughs: guides. Account/device questions: FAQ. Wrong streaming country is still partly a node problem—region guide—not a DNS shrine.