Identify an IP leak: DNS, WebRTC & IPv6

Quick answer

A VPN can leak your real identity through three separate pipelines, even while it appears to be working. A proper privacy audit checks all three: WebRTC, DNS, and IPv6. Here’s how to test each.

The baseline check

First, with the VPN on, load our homepage and confirm the IP, location, and ISP shown belong to the VPN, not you. This catches the most basic failure — a VPN that isn’t actually routing your traffic. If your real details show here, nothing else matters until that’s fixed.

Leak 1: WebRTC

WebRTC can expose your real IP through the browser, outside the VPN tunnel. Run our WebRTC Leak Test with the VPN on. If your real public IP appears, you have a WebRTC leak — fix it via the Chrome/Brave/Edge or Firefox guides. This is the single most common VPN leak.

Leak 2: DNS

A DNS leak happens when your domain lookups go to your ISP’s DNS servers instead of through the VPN, revealing what you browse to your ISP even though your traffic is encrypted. The tell-tale sign is DNS requests resolving via your ISP’s servers rather than the VPN’s. Most quality VPNs route DNS through their own resolvers — enable the VPN’s “DNS leak protection” setting if results look wrong.

Leak 3: IPv6

This is the sneaky one. Many VPNs only tunnel IPv4. If your connection also has IPv6, your real IPv6 address can bypass the VPN entirely — the VPN masks IPv4 while IPv6 leaks your true address. Check both protocols on our homepage: if an IPv6 address shows and it’s not the VPN’s, you have an IPv6 leak. Enable the VPN’s IPv6 leak protection, or disable IPv6 on your device.

Putting it together

A truly sealed VPN passes all four: the homepage shows the VPN’s IPv4 and IPv6 (or no IPv6 at all), WebRTC exposes nothing, and DNS resolves through the VPN. Re-audit after changing networks, browsers, or VPN servers — leaks often appear only on specific transitions.