Back to Blog
ExplainersJuly 30, 2026·6 min read

DNS Leaks and VPN Security: Casper's Cloak's Approach

A single HN thread about Tailscale and Mullvad DNS leaks doesn't mean all VPNs leak. Learn how Casper's Cloak uses WireGuard, server-side DNS filtering, AI threat detection, and Smart Bypass to protect your network traffic.

C

Casper's Cloak Security Team

July 30, 2026

A single Hacker News thread titled “Tailscale with Mullvad leaks your DNS” does not prove that any specific VPN or setup always leaks DNS.

What the HN signal actually says

A Hacker News mention observed on 2026-07-30 had:

  • Title: “Tailscale with Mullvad leaks your DNS”
  • A matched term of “Mullvad”
  • Zero comments at the time of observation
  • A link to a GitHub issue

From this, we can safely say:

  • There was a discussion prompt about a possible DNS-leak scenario when using Tailscale with Mullvad.
  • The content of the GitHub issue itself is not part of the available sources here, so we cannot describe its technical details or conclusions.
  • We cannot generalize from this single mention to claim that “VPNs leak DNS” in general.

How Casper's Cloak approaches network protection

Casper's Cloak is positioned as an AI-enhanced privacy and network-security platform for iPhone, Android, and Mac users. It is not positioned as only a VPN; a VPN is one of the tools it uses.

Casper combines:

  • Encrypted transport: a WireGuard VPN encryption tunnel, including public-Wi-Fi protection and kill-switch-style tunnel hardening.
  • DNS/network filtering: DNS-level filtering and blocking, running server-side on Casper's managed VPN exit servers.
  • AI threat detection: an AI security layer that performs real-time analysis of network connections, with machine-learning threat detection, zero-day phishing detection, malware detection and blocking, domain-reputation analysis, and real-time threat classification using connection and domain features.
  • Anti-tracking and privacy: system-wide ad and tracker blocking across apps, traffic camouflage and decoy traffic (Phantom Barriers), and protection against browsing-pattern analysis.

Casper is a hybrid design: it combines on-device threat detection with server-side DNS and network filtering and routes traffic through an encrypted WireGuard tunnel.

User control: Smart Bypass and split tunneling

Casper's design emphasizes user control over routing:

  • Smart Bypass is a user-configured exclusion list.
    • You can enable service presets and/or add custom domains and IP ranges.
    • Those destinations are then excluded from the tunnel.
    • It is not automatic and does not classify individual flows.
  • Split Tunneling in Casper supports domain-based and IP-based exclusion using the same live path as Smart Bypass.

The honest framing is user control: you choose what leaves the tunnel.

Sensitive destinations and decoy cover

Casper includes Sensitive Site Detection for certain categories:

  • When a banking, healthcare, government, or cryptocurrency destination is observed by DNS inside the tunnel, Casper:
    • Raises an in-app advisory, and
    • Automatically triggers Phantom Barriers decoy traffic to cover the visit.
  • The tunnel itself is never altered, re-keyed, re-routed, or otherwise changed for these sites.
  • For banking, the in-app advisory currently recommends disconnecting from the VPN before accessing banking.

If a user chooses to place a banking domain into Smart Bypass:

  • That destination will leave the encrypted tunnel.
  • It will also lose decoy cover, because Sensitive Site Detection only observes DNS for destinations still inside the tunnel.

Why this matters for VPN and DNS discussions

The HN thread about “Tailscale with Mullvad leaks your DNS” is a discussion prompt about a possible DNS-leak scenario when using Tailscale with Mullvad.

Casper's Cloak focuses on:

  • Combining encrypted transport with DNS-level filtering and an AI threat-detection layer
  • Giving users explicit control over what stays inside or outside the tunnel via Smart Bypass and split tunneling
  • Providing anti-tracking and decoy-traffic features to protect against tracking and browsing-pattern analysis

For more details on Casper's capabilities and plans, visit casperscloak.com.

Privacy that travels with you

Casper's Cloak combines WireGuard encryption, server-side DNS filtering, and AI threat detection — all in one app.

Get Started Free