← Back to Blog

Is Your VPN Leaking Your DNS or IP? Free Test + Fix (2026)

E

Short answer: to check if your VPN is leaking, note your real IP address with the VPN off, then connect and visit a leak-test site such as ipleak.net, dnsleaktest.com, or browserleaks.com. If any IP address (including IPv6) or DNS server shown belongs to your real internet provider instead of the VPN, you have a leak. Most leaks come from IPv6, custom DNS settings, WebRTC in the browser, or a kill switch that's switched off, and each has a quick fix.

A VPN app showing a green "Connected" badge only tells you the tunnel is up. It doesn't prove that every request your device makes goes through it. This guide explains the three common leak types, how to test for each in a few minutes, and how to fix what you find.

What is a DNS leak, an IP leak, and a WebRTC leak?

A VPN should do two things: send your traffic through an encrypted tunnel so websites see the VPN server's IP instead of yours, and handle your DNS lookups (turning a name like example.com into a server address) inside that same tunnel. A leak is any traffic that escapes.

  • DNS leak: your device sends lookups to your ISP's or another resolver outside the tunnel. Websites still see the VPN IP, but whoever runs that resolver sees every domain you visit.
  • IP leak: your real public IP is visible to websites. Common causes are IPv6 traffic that bypasses an IPv4-only tunnel, or a dropped connection with no kill switch.
  • WebRTC leak: WebRTC is the browser technology behind video calls and peer-to-peer features. It can expose IP addresses to a web page's scripts, so a misconfigured browser can reveal your real IP even while the VPN works.

How do I test my VPN for leaks? Step by step

  1. Record your real details. Disconnect the VPN, open ipleak.net, and note your IPv4 address, any IPv6 address, and your ISP's name.
  2. Connect the VPN and reload. The IP, location, and ISP should now belong to the VPN server.
  3. Check IPv6. If an IPv6 address appears and it belongs to your ISP, you have an IPv6 leak. If no IPv6 shows, or it belongs to the VPN, you're fine.
  4. Run an extended DNS test on dnsleaktest.com. Every server listed should belong to the VPN provider or a resolver it routes through, never your ISP.
  5. Test WebRTC at browserleaks.com/webrtc. Your real public IP should not appear.
  6. Test the kill switch. With the VPN connected, briefly turn Wi-Fi off and on, then reload a test site immediately. A working kill switch blocks traffic until the tunnel is back.

Repeat on each device you use. Phones, laptops, and browsers can behave differently even with the same VPN account.

💡 Test during reconnects, not just while connected

Many leaks happen for a few seconds when a laptop wakes from sleep or a phone switches from Wi-Fi to mobile data. That's why the kill-switch test matters as much as the basic check.

What causes VPN leaks?

  • IPv6 handling. Some VPN apps and manual configurations only tunnel IPv4. If your ISP provides IPv6, that traffic can travel outside the tunnel. Good apps either tunnel IPv6 or block it while connected.
  • Custom DNS settings. A DNS server set manually on your router or device, or a browser's "secure DNS" option pointed at a third-party resolver, can bypass the VPN's DNS.
  • Kill switch off or unreliable. Kill switches aren't always enabled by default, and implementations vary across operating systems.
  • WebRTC. Browsers handle WebRTC themselves, so a VPN app can't fully control it from outside the browser.
  • Split tunneling. Excluding apps or websites from the VPN is useful, but if your browser is on the excluded list, it leaks by design.
  • Manual configs and third-party clients. Hand-made OpenVPN or WireGuard configs often lack the leak protection built into the provider's own app.

How do I fix a DNS or IP leak?

  1. Turn on the kill switch in the app and repeat the reconnect test.
  2. Enable IPv6 leak protection if your app has it. If not, disable IPv6 on the network adapter or router while you use the VPN.
  3. Remove custom DNS from your device and router, or set the VPN app to use its own DNS servers. Check your browser's secure DNS setting too.
  4. Review split tunneling and turn it off if you don't need it.
  5. Use the provider's own app instead of a manual configuration where possible, and keep it updated.
  6. Retest after every change so you know which one fixed it.

How do I stop a WebRTC leak?

In Firefox, you can disable WebRTC entirely by setting media.peerconnection.enabled to false in about:config (this breaks browser-based video calls). In Chrome and Edge, use an extension that limits WebRTC, or the browser extension from your VPN provider, many of which include WebRTC protection. Brave has a WebRTC IP-handling setting in its privacy options. Retest at browserleaks.com afterward.

Do VPNs leak on Android and iPhone?

Phones leak in their own ways, mostly when switching between Wi-Fi and mobile data. On Android, open Settings, find the VPN entry for your app, and turn on Always-on VPN and Block connections without VPN; together they act as a system-level kill switch. On iPhone and iPad, enable the app's kill switch or "connect on demand" option if it has one. Security researchers have reported that iOS can let some existing connections and Apple system services bypass a newly started VPN tunnel, so for sensitive use connect the VPN before opening other apps. Then run the same browser-based tests on mobile data and on Wi-Fi.

Which VPNs are best at preventing leaks?

Look for a provider whose app has an always-on kill switch, built-in DNS and IPv6 leak protection, and an independently audited no-logs policy.

  • Proton VPN publishes its apps as open source, so anyone can inspect the leak-protection code, and its no-logs policy has been audited by Securitum several years running, most recently in 2025.
  • NordVPN says its apps use only NordVPN-operated DNS servers by default and resolve queries on the VPN server you're connected to (per its DNS leak page). Its no-logs policy has been assessed by Deloitte multiple times, most recently in December 2025.
  • Surfshark includes a kill switch and private DNS, allows unlimited devices, and had its no-logs policy verified by Deloitte again in 2025.

Whatever you pick, test it yourself. See our privacy-first VPN picks, the NordVPN vs Proton VPN comparison, and how we evaluate providers in our methodology. Torrent users should also read our torrenting VPN guide, since an IP leak matters most there.

Frequently Asked Questions (FAQ)

Can a VPN leak my IP even if it says Connected?

Yes. "Connected" only confirms the tunnel is up. IPv6 traffic, WebRTC, custom DNS, or split tunneling can still bypass it, which is why a separate leak test is worth doing.

Is a DNS leak as serious as an IP leak?

They expose different things. A DNS leak reveals which sites you visit to whoever runs the resolver (often your ISP). An IP leak reveals your real IP and approximate location to the websites themselves. Fix both.

Do free VPNs leak more often?

Research suggests many do. A 2016 study of 283 Android VPN apps found that about 84% didn't tunnel IPv6 traffic and 66% didn't tunnel DNS. See the hidden dangers of free VPNs.

How often should I test my VPN for leaks?

After installing a VPN, after major app or operating system updates, when you change routers or networks, and every month or so if you rely on the VPN for sensitive activity.

Check out the Best VPNs of 2026