How to Check If Your VPN Is Leaking: DNS, IP, IPv6 and WebRTC Tests

A VPN that is connected is not always a VPN that is protecting you. A leak means some of your traffic or identifying information is still travelling outside the encrypted tunnel, which defeats the main reason most people install one. The good news is that checking takes about five minutes and costs nothing. This guide shows the process I would follow, explains what each result means, and links to the free tools and standards behind it. I am describing a method here, not reporting lab results for any particular VPN.

See our affiliate disclosure and how we review. Updated: November 2026

The four leaks worth checking

• IP leak: websites still see your real public IP address instead of the VPN server’s.
• DNS leak: your device asks your ISP’s DNS servers (or another resolver outside the VPN) which sites you want to visit, even though the web traffic itself is tunnelled.
• IPv6 leak: the VPN only handles IPv4, so any IPv6 traffic bypasses it.
• WebRTC leak: a browser feature used for video calls can reveal network addresses to the sites you visit. The mechanism is described in RFC 8828, the IETF document on WebRTC IP address handling.

Step 1: record your baseline with the VPN off

Before you connect, open a leak-test page and note your real public IP address and your ISP name. You need this to know what a leak looks like. Three free tools I would use are DNSLeakTest, Mullvad’s connection check and BrowserLeaks. All of them see your IP address by definition, so they are third parties and you are trusting them with that. Mullvad’s checker is run by a VPN vendor, which is worth knowing when you read the results.

Step 2: connect and compare the IP address

Connect to a server in a country you can recognise, reload the same page and compare. You should see a different IP address, and the location and ISP should match the VPN server rather than your home. If your real IP address or ISP still appears, you have a basic IP leak. Stop here and check that the app is actually connected, not stuck reconnecting.

Step 3: run a DNS leak test

Run the extended test on a DNS leak page while connected. Look at the resolvers it lists. If you see your own ISP’s name, your DNS requests are escaping. If you see your VPN provider, or a public resolver that the VPN says it uses, that is expected behaviour. Comparitech’s DNS leak test includes a plain-English explanation of how to read the output.

A common source of false alarms: if your VPN lets you pick a custom DNS provider such as a public resolver, that provider will show up in the results. That is not a leak, because you chose it. It is only a leak if it is something you did not expect.

Step 4: check IPv6

Look at the IPv6 section of the BrowserLeaks IP page while connected. If it reports an IPv6 address that belongs to your ISP, that traffic is bypassing the tunnel. If it says you have no IPv6, you are fine on this point. Some VPNs tunnel IPv6 properly, some block it, and some ignore it, so this is the check that most often surprises people.

Step 5: check WebRTC

Use the BrowserLeaks WebRTC page or the ExpressVPN WebRTC test (a vendor tool, again worth remembering) while connected. A public IP address that matches your real one is a leak. A local address starting with 192.168 or 10. is a private network address and, on its own, is not a problem. Firefox users can adjust WebRTC behaviour in browser settings, and Chrome users can try Google’s own WebRTC Network Limiter extension. Many VPN apps and browser extensions also offer their own WebRTC protection.

How to read your results

Fixes that usually work

1. Update the VPN app. Leak protections are often added or fixed in newer versions.
2. Turn on the kill switch, which blocks traffic if the tunnel drops. Providers name and place it differently, so check your app’s settings.
3. Switch protocol. If a leak only happens on one protocol, move to another such as WireGuard-based or OpenVPN options if your app offers them.
4. Disable IPv6 at the OS level if your VPN does not handle it.
5. Restrict WebRTC in the browser, then retest.
6. If nothing works after retesting twice, contact support with screenshots, or consider another provider.

NordVPN and Proton VPN both describe DNS leak protection in their own documentation. NordVPN, for example, states that its NordWhisper protocol prevents DNS requests from leaving the tunnel (NordVPN blog). That is a vendor claim, which is why running the test yourself still matters. My NordVPN review and Proton VPN review cover the rest of each service, and the head-to-head comparison shows how they stack up. To shortlist other options, start with the best VPN guide.

What a clean result does not prove

A passing leak test shows that, at that moment, those four channels were not exposing you. It does not make you anonymous. Browser fingerprinting, logged-in accounts, cookies and a VPN provider that keeps logs are all outside what these tests measure. Run the test again after major OS or browser updates, when you switch networks, and when you change servers or protocols.

Disclosure: this article contains no affiliate links at the time of writing. If that changes, links will be marked.

Frequently asked questions

How often should I run a VPN leak test?

Run one right after installing the VPN, then again after big OS or browser updates, when you change protocol, and whenever the connection behaves oddly. It takes about five minutes.

Is a leak test site safe to use?

Leak test sites necessarily see your public IP address, so you are trusting them with that. Stick to well-known tools, and remember that some are run by VPN vendors who may have an interest in what they show.

Does seeing a 192.168 address in a WebRTC test mean I am leaking?

No. Addresses starting with 192.168 or 10. are private local-network addresses. A leak is when your real public IP address appears.

Should I turn off IPv6 to stop leaks?

If your VPN does not tunnel or block IPv6 traffic, disabling IPv6 on your device is a reasonable fix. If the VPN handles IPv6 properly you do not need to.

Does a kill switch stop all leaks?

It protects against traffic leaking when the VPN connection drops. It does not fix DNS, IPv6 or WebRTC leaks that happen while the VPN is connected, so you still need to test those.