How to check your VPN for DNS, IPv6 and WebRTC leaks

What is a VPN leak?

When a VPN works, websites see the VPN server's IP address, and your internet provider sees only encrypted traffic going to that server. A leak is anything that escapes that tunnel: a request sent outside it, or a feature that tells a website your real address anyway.

Leaks aren't a theoretical worry. A 2015 study by Perta and colleagues, including researchers at Queen Mary University of London, published in Proceedings on Privacy Enhancing Technologies, examined 14 popular commercial VPNs and found that most leaked IPv6 traffic. A 2016 study of 283 Android apps that use the VPN permission, led by CSIRO's Data61, reported that about 84% didn't send IPv6 traffic through the tunnel and about 66% didn't send DNS traffic through it. Apps have improved since then, but these are the failure points to check.

DNS leaks

DNS is the internet's address book. Before your browser loads a site, it asks a DNS server to turn a name like example.com into an IP address. Those lookups reveal every site you visit. Normally your VPN sends lookups through the tunnel to its own DNS servers.

A DNS leak happens when lookups go to your ISP's or your network's DNS server instead. Websites still see the VPN's address, but your ISP can see which sites you look up. Common causes are an operating system that sends lookups to several resolvers at once, a VPN app that doesn't override the system's DNS settings, or a router that intercepts DNS.

How to check for a DNS leak

Tunnelcheck doesn't run its own DNS test yet. These well-known external tests work by making your device look up unique test names and recording which DNS servers ask for them:

• dnsleaktest.com: a simple DNS leak test. Its privacy policy is published by IVPN Limited, a VPN company.
• ipleak.net: shows your IP address, the DNS servers answering your lookups, WebRTC addresses and IPv6. It's run by the VPN company AirVPN.
• browserleaks.com: a larger set of browser tests, including a DNS leak test, WebRTC and fingerprinting checks.

Two of these sites are operated by VPN companies. The tests are standard and the results are easy to read yourself, but keep that in mind when a site suggests a product. Read the results this way: if any listed DNS server belongs to your home ISP or your local network rather than your VPN provider, you have a leak.

IPv6 leaks

Most devices now have two kinds of IP address: the older IPv4 (like 203.0.113.5) and the newer IPv6 (like 2001:db8::1). If your VPN only tunnels IPv4, your device may still send IPv6 traffic directly. A site that supports IPv6 then sees your real IPv6 address, which can point to your home connection.

The 2015 PETS paper explained why: many VPN clients changed the IPv4 routing table but ignored the IPv6 one. Its authors recommended that apps take over IPv6 routes too, or block IPv6 while connected. Many apps now do one of these.

How to check for an IPv6 leak

1. Connect to your VPN Pick any server.
2. Open our IP tool Go to What is my IP. It shows the address your connection reaches us from.
3. Check both families Use ipleak.net, which can check IPv4 and IPv6 separately. If an IPv6 address appears and it isn't the VPN's, IPv6 is leaking.
4. Fix it Turn on your VPN app's IPv6 leak protection if it has one, or ask the provider whether it tunnels or blocks IPv6.

WebRTC leaks

WebRTC is a browser feature for video calls and other live connections. To connect two people directly, it tries to discover all of your device's IP addresses, using a method called ICE that queries outside servers (STUN servers). A web page can trigger this from ordinary JavaScript.

The IETF standard on WebRTC IP handling (RFC 8828, January 2021) describes the privacy problem directly: these checks can reveal a user's local network addresses, and can reveal the public address of a user who is behind a proxy. A full-device VPN usually covers WebRTC traffic too, but browser-only VPN extensions and some setups can leave it exposed.

How to check for a WebRTC leak

Run our WebRTC leak test while connected to your VPN. It runs in your browser and lists the addresses WebRTC exposes. If you see your real public IP address, WebRTC is leaking. A local address such as 192.168.x.x is less serious, but it still adds to the information a site can collect about you. browserleaks.com and ipleak.net offer WebRTC checks too.

Fixes include using the VPN's full desktop app rather than only a browser extension, turning on the app's WebRTC protection if it has one, or limiting WebRTC in your browser's privacy settings. Some private browsers restrict it by default. See private browsers.

A five-minute leak check routine

1. Before connecting Open What is my IP and note your real IP address and ISP.
2. Connect Turn on the VPN and reload. The address and ISP should now be the VPN's.
3. DNS Run the DNS test on dnsleaktest.com or ipleak.net. No DNS server should belong to your own ISP.
4. IPv6 Check that no IPv6 address of yours appears.
5. WebRTC Run our WebRTC leak test.
6. Drop test Switch networks or disconnect briefly and check that your kill switch blocks traffic.

Other things that can identify you

• Browser fingerprinting: sites can recognize your browser from its settings, fonts and hardware details, whatever your IP. Our browser privacy check shows some of what a site sees.
• Logged-in accounts: if you sign in to a service, it knows who you are regardless of the VPN.
• Torrent clients: these can be configured to bypass a VPN. ipleak.net has a torrent address check. A VPN doesn't make sharing copyrighted files legal.