Your VPN could be leaking your real IP address right now -- and you would have no idea.
A VPN leak is not a dramatic failure. Your connection does not drop. No warning appears. The VPN app shows a green checkmark. Meanwhile, every site you visit can see your actual location, your real DNS requests go straight to your ISP, and the no-logs promise your provider made is meaningless.
This guide shows you exactly how to run a VPN leak test in under 5 minutes, what each result means, and how to fix the four leak types we find most often in our testing.
A VPN leak occurs when data travels outside the encrypted VPN tunnel, exposing information the VPN was supposed to hide. There are four main types: IP address leaks (your real IPv4 or IPv6 address becomes visible), DNS leaks (your domain name queries reach your ISP instead of the VPN's servers), and WebRTC leaks (browsers expose your real IP through peer-to-peer connection negotiation). Studies show that 21% of VPNs leak DNS requests and 23% have WebRTC leaks -- meaning roughly 1 in 4 VPNs fail their core job in at least one test. Leaks are most common after network changes, sleep/wake cycles, and on mobile devices switching between Wi-Fi and cellular.
What Is a VPN Leak?
A VPN routes your traffic through an encrypted tunnel and replaces your real IP address with the server's IP. A leak happens when some of that traffic escapes the tunnel and reaches the open internet in plain form.
The result: a website or your ISP can see your real IP address, the DNS queries that reveal which sites you visit, or both -- even though the VPN is technically connected.
Leaks are not always caused by a broken VPN. They can happen because:
- Your OS sends DNS queries through the system resolver instead of the VPN's DNS
- Your browser uses WebRTC to negotiate peer connections, bypassing the VPN entirely
- Your network supports IPv6 but your VPN only tunnels IPv4 traffic
- A brief network interruption drops the tunnel before the kill switch fires
The only way to know for certain is to test. Here is how.
The 4 Types of VPN Leaks You Need to Test For
IP Address Leaks
The most obvious failure. If a leak test shows your real home IP address while the VPN is connected, the tunnel has broken down completely. Your real location, ISP, and identity are exposed to every site you visit.
DNS Leaks
DNS (Domain Name System) is the service that translates "google.com" into an IP address. Every time you visit a site, a DNS query goes out. A DNS leak means those queries are going to your ISP's DNS servers -- not the VPN's -- which means your ISP has a complete log of every domain you visited, even while the VPN was running.
This is the most common leak type. We find it in roughly 1 in 5 VPNs tested, including some with explicit "DNS leak protection" marketing claims.
WebRTC Leaks
WebRTC is a browser technology used for video calls, gaming, and real-time communication. To function, it asks STUN servers for your real IP address -- including the IP behind any VPN or NAT. Websites can trigger this silently with a few lines of JavaScript.
Result: your real IP appears in the browser even when the VPN tunnel is otherwise intact. This is a browser-level leak, not a VPN protocol failure, which is why many VPNs miss it.
IPv6 Leaks
Most home networks now support both IPv4 and IPv6. Many VPNs only encrypt IPv4 traffic. If your network sends an IPv6 request and the VPN does not handle it, that request goes out unprotected -- carrying your real IPv6 address.
IPv6 leaks are underreported because most users do not know they have an IPv6 address, and most basic leak tests do not check for them.
Step 1 -- Run the Baseline Test (Before You Connect)
Before you can identify a leak, you need a reference point: your real IP address and DNS server without the VPN running.
Do this first:
- Make sure your VPN is fully disconnected
- Go to ipleak.net or browserleaks.com
- Note your real IPv4 address
- Note your real IPv6 address (if shown)
- Note your DNS server IP addresses (shown in the DNS section)
- Take a screenshot -- you will compare this to the connected results
This baseline is your ground truth. If any of these values appear again after connecting to the VPN, you have a confirmed leak.
Step 2 -- Test for IP and DNS Leaks
- Connect to your VPN and choose a server in a country different from yours
- Go to ipleak.net or dnsleaktest.com
- Run the extended test (not just the basic test)
- Compare the results to your baseline
What you want to see:
- IPv4 address: the VPN server's IP (not your real IP)
- DNS servers: your VPN provider's DNS servers (not your ISP's)
What a leak looks like:
- Your real home IP appears anywhere on the page
- DNS servers show your ISP's name (e.g., Comcast, AT&T, Verizon) instead of the VPN's
To run a reliable DNS leak test, first disconnect your VPN and record your ISP's DNS server addresses at ipleak.net. Then reconnect to a VPN server in a different country and run the extended DNS test on dnsleaktest.com. A passing result shows only the VPN provider's DNS servers -- typically labeled with the VPN company's name or a neutral hosting provider. A failing result shows your ISP's DNS servers still appearing alongside or instead of the VPN's. If you see any DNS server that matches your baseline test, your VPN is leaking DNS queries to your ISP regardless of whether your IP address appears correct.
Step 3 -- Test for WebRTC Leaks
WebRTC leaks require a browser-specific test because they occur at the browser level, not the network level.
- With your VPN connected, open your browser (Chrome, Firefox, or Edge)
- Go to browserleaks.com/webrtc or vpnmentor.com/tools/ip-leak-test-vpns-tor
- Check the "Your IP Addresses" section
What you want to see:
- Only the VPN server's IP listed
- No local (192.168.x.x) or real public IP addresses
What a leak looks like:
- Your real public IP appears as a "local candidate" or "public candidate"
- Your home network's local IP (192.168.x.x) is visible -- less dangerous but still a fingerprinting risk
If you find a WebRTC leak:
The fix is browser-level, not VPN-level:
- Firefox: Go to
about:config, search formedia.peerconnection.enabled, set it tofalse - Chrome: Install the "WebRTC Control" or "uBlock Origin" extension and enable WebRTC leak protection
- Edge: Go to
edge://flags, search for "Anonymize local IPs exposed by WebRTC", enable it
Some VPN desktop apps automatically handle this. Check your VPN's settings for a "WebRTC leak prevention" option before modifying browser settings manually.
Step 4 -- Test for IPv6 Leaks
- With your VPN connected, go to ipv6leak.com or test-ipv6.com
- Check whether your real IPv6 address appears
What you want to see:
- "No IPv6 address detected" or only the VPN server's IPv6 address
What a leak looks like:
- Your real IPv6 address appears -- this is a confirmed leak
If your VPN is leaking IPv6:
The cleanest fix is to use a VPN that fully handles IPv6 -- either by tunneling it alongside IPv4 or by blocking all IPv6 traffic when connected. Check your VPN's settings for "IPv6 leak protection" or "block IPv6."
If the option is not available, you can disable IPv6 at the OS level:
- Windows: Open Network Adapter Settings > Properties > uncheck "Internet Protocol Version 6 (TCP/IPv6)"
- macOS: System Settings > Network > select your connection > Details > TCP/IP > set "Configure IPv6" to "Link-local only"
This is a blunt workaround. The better solution is to use a VPN that handles IPv6 natively -- which we cover below.
How to Fix Each Leak Type
| Leak Type | Quick Fix | Proper Fix |
|---|---|---|
| IP leak | Reconnect VPN | Switch to a VPN with a kill switch |
| DNS leak | Enable DNS leak protection in VPN settings | Use a VPN that runs its own DNS servers |
| WebRTC leak | Disable WebRTC in browser settings | Use a VPN app with built-in WebRTC blocking |
| IPv6 leak | Disable IPv6 in OS network settings | Use a VPN with full IPv6 support or IPv6 blocking |
For DNS leaks specifically: most reputable VPN providers run their own DNS servers and route all DNS queries through the tunnel by default. If yours does not, that is a red flag worth noting -- and a reason to look at the best VPN options for 2026.
VPNs That Passed All 4 Tests in Our Lab
We run these four tests on every VPN we review. Based on our testing:
- Mullvad -- passed all 4 tests, including IPv6. Uses RAM-only servers with no logs. Full results in our Mullvad VPN review.
- ProtonVPN -- passed all 4 tests. Strong DNS leak protection built in. See our ProtonVPN review.
- NordVPN -- passed IP, DNS, and IPv6. WebRTC protection requires enabling the browser extension separately. See our NordVPN review.
- ExpressVPN -- passed all 4 tests in standard configuration. Results in our ExpressVPN review.
VPNs that failed one or more tests in our testing: several budget and free providers. We do not link to them here -- the point is that a passing score on the provider's own leak test page does not mean they pass independent testing.
If your current VPN is leaking and you cannot fix it through settings, the safest move is to switch to one that has passed independent leak testing. Our best VPN 2026 guide covers the full results.
FAQ
How often should I run a VPN leak test?
Run a full test when you first set up a VPN, after any app update, after a network change (new Wi-Fi, travel, hotspot), and any time you notice unusual behavior. A monthly check is also reasonable if you rely on your VPN for sensitive work.
Can a VPN leak if the kill switch is on?
Yes. A kill switch blocks internet access if the VPN tunnel drops -- it does not prevent DNS or WebRTC leaks. Those are separate failure modes that require separate protections.
Does a DNS leak mean my VPN is useless?
For IP privacy, no -- your real IP is still hidden. But your browsing history is exposed to your ISP, which defeats the main privacy reason most people use a VPN. Fix it.
Why does my VPN pass the provider's own leak test but fail on third-party tools?
Some providers' own test pages only check IPv4. Third-party tools like ipleak.net and browserleaks.com test all four vectors. Always use independent tools.
Is a WebRTC leak my VPN's fault?
Not entirely. WebRTC is a browser feature that operates at the application layer, above the VPN tunnel. VPN apps that include browser extensions can block it, but if yours does not, the fix is on the browser side.
What is the fastest way to check for leaks right now?
Go to ipleak.net with your VPN connected. If you see your real IP or your ISP's DNS servers, you have a leak. Run the extended test to confirm which type.
Key Takeaways
- Run your baseline test before connecting so you know what to compare against
- DNS leaks affect ~21% of VPNs -- check even if the app claims protection
- WebRTC leaks are browser-level and require a browser fix, not just a VPN fix
- IPv6 leaks are common and easy to miss -- use a dedicated IPv6 test tool
- If you cannot fix the leak through settings, the VPN itself may be the problem
The 5-minute test above tells you exactly where you stand. If you are looking for VPNs that consistently pass all four, start with our best VPN 2026 results -- every pick was tested for leaks before making the list.
