WireGuard DNS Not Working: Complete Troubleshooting Guide
DNS problems can make a healthy WireGuard tunnel look broken. Test a known IP first, then test the resolver path.
Test IP connectivity first
If IP traffic fails, return to forwarding, NAT, and AllowedIPs. If IP works but names fail, focus on the resolver.
Set an explicit resolver
A client profile can include DNS = 1.1.1.1 or another resolver you trust. Inspect the active resolver after reconnecting.
Check split tunneling
With split tunneling, DNS may intentionally stay outside the VPN. With full tunneling, ensure the resolver route is included.
Check local overrides and leaks
VPN apps, browsers, captive portals, and enterprise profiles can override DNS. Use a leak test and fix the specific override.
Quick checklist
- IP is tested before DNS.
- The active resolver is inspected.
- Split versus full tunnel is intentional.
- A DNS leak test confirms the result.
This guide focuses on practical self-hosting. See the complete WireGuard server guide for the full setup. Tired of maintaining the server yourself? ZeroBlock handles the VPN infrastructure so you can connect without managing a VPS.