DNS Leak in Adguard Home

Routers VPN, DNS, Leaks
1

Hi team, I am using VPN with Policy Mode, I realized in AdGuard Home, there is native DNS being query, and it is towards my ISP DNS server.

May I know why does it happened? I didn’t put ISP DNS in the fallback server as well.

Screenshot as below, the port 53 is the ISP DNS.

image
image598×389 13.8 KB

Below is some strange log:

Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820483 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:48468->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820556 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:33337->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820469 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:47109->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820469 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:37098->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820469 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:40288->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:52 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:52.820555 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:47348->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828365 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:58295->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828365 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:56619->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828365 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:54678->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828365 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:57947->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828440 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:42585->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:21:53 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:21:53.828448 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:34342->ISP.DNS.IP.ADDR:53: i/o timeout"
Sat Sep 13 16:25:21 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:25:21.976725 ERROR response received addr=202.ISP.DNS.IP:53 proto=udp status="exchanging with 202.ISP.DNS.IP:53 over udp: read udp 10.136.216.3:52042->202.ISP.DNS.IP:53: i/o timeout"
Sat Sep 13 16:25:21 2025 user.notice AdGuardHome[16006]: 2025/09/13 16:25:21.976711 ERROR response received addr=ISP.DNS.IP.ADDR:53 proto=udp status="exchanging with ISP.DNS.IP.ADDR:53 over udp: read udp 10.136.216.3:60753->ISP.DNS.IP.ADDR:53: i/o timeout"

3

Hi

It looks like this behavior is coming from AdGuard Home rather than from the router.

Could you please review your AdGuard Home configuration?
In addition to the general DNS settings, check whether any specific DNS server has been assigned to individual devices under the Client settings.

4

Hi @will.qiu , yes, I have specified Client Settings and specify some IPs to route to another DOH server. I don’t specify ISP DNS.

5

Please export the log according to the screenshot below.

image
image1430×911 87 KB

Then send it to us via private message so we can check it further.

image
image632×233 19.1 KB

6

Log sent, kindly check.

7

Please verify that the following option is enabled.

When this option is enabled, AdGuard Home may, in specific scenarios, use the DNS from the WAN interface to resolve requests.
This behavior is typically related to internal network queries and does not result in a DNS leak where your ISP can see your browsing activity.
It only applies to requests for domain names that correspond to your Private IP address.

image
image1186×511 24.3 KB

8

May I know if it is ok to disable?

9

I was experiencing the same thing. Thought it was ‘normal’ behavior.

A quick Google search says you can put your router's IP address in that field. It allows AGH to see the hostnames of your lan devices.

Screenshot_20250919_214834_Chrome
Screenshot_20250919_214834_Chrome2656×1174 212 KB