A VPN hides your traffic, yet your DNS lookups can still leave through your internet provider and list every site you open. This test checks DNS, WebRTC and IPv6 in a few seconds and tells you, in plain words, whether something leaks and through which network.
Updated on · by Maurizio Fonte
The test starts by itself and takes about ten seconds. If you use a VPN, connect it before opening the page, then run the test again whenever you change network or settings.
The test queries ipleak.net, ipwho.is, ipify, Cloudflare (DNS over HTTPS and STUN) and Team Cymru. Results stay on this page: we do not receive or store them.
Want to know whether your DNS blocks ads and trackers? Try the DNS ad blocking test.
Turn the VPN on as you normally would, then open this page. You can also run the test without a VPN just to learn which DNS you are using.
Your browser looks up a few throwaway domain names created for this test only. The authoritative server for those names records who asked: those are the DNS resolvers working on your behalf.
Each resolver is mapped to its network (its autonomous system) and compared with the network your traffic exits from. Traffic leaving through the VPN while DNS leaves through your provider is a leak.
In the same run the browser is asked which addresses it would expose to a video call (WebRTC), and whether an IPv6 connection bypasses the VPN tunnel.
Every check ends with a clear result and, when something is wrong, the fix for Windows, macOS, Android, iPhone, your browser or your router.
Every site you open starts with a DNS lookup: your device asks a resolver to turn a name such as mybank.com into an IP address. In most setups that question travels in clear text and contains the name of the site. Whoever runs the resolver can keep a timestamped list of the sites you visit, even though the pages themselves are encrypted with HTTPS.
Without a VPN the resolver is almost always your internet provider's, handed out by the router. With a VPN you expect the lookups to go through the tunnel to a resolver run by the VPN. When they do not, your traffic exits from one country and network while your DNS exits from another: you are paying to hide, and your provider still knows where you go. That is a DNS leak.
Most online leak tests show a table of IP addresses and leave the interpretation to you. An address like 2620:171:63::227 means nothing to most people. Here every resolver is traced back to the network that owns it, named, and compared with the network you exit from, so the verdict comes already explained.
Same network for traffic and DNS. The usual picture when the VPN works: the resolver belongs to the same autonomous system as the address you exit from. No leak. Without a VPN you will see your provider's network for both traffic and DNS: consistent, just unprotected.
A well-known public resolver. The resolver belongs to a public service such as Cloudflare, Google, Quad9, NextDNS or AdGuard. That is not necessarily a problem: many VPNs forward lookups to exactly these services, and if you picked one yourself you will find it here. We name the service so you can tell whether it is the one you expect.
A different, non-public network. Your traffic exits from one network and your DNS from another that is not a public service. If you are on a VPN, that second network is nearly always your home or office provider: the classic leak, shown in red with the fixes below.
Several resolvers at once. Seeing two or three addresses is normal, since large resolvers run many machines. What matters is the network, not the count. If even one resolver from your provider appears next to the VPN's, some lookups are escaping the tunnel.
In the VPN app. Look for options named DNS leak protection, use VPN DNS or similar and turn them on, together with the kill switch that cuts the connection if the tunnel drops. If the app offers WireGuard or OpenVPN with its own DNS, prefer that over manual setups.
Windows. Windows can send the same DNS question over every network adapter at once and use the fastest answer, your provider's included. The feature is called smart multi-homed name resolution. Good VPN clients neutralise it; if the leak persists, disable it with the group policy Turn off smart multi-homed name resolution, and make sure no DNS servers are hard-coded on your physical adapter.
macOS and iPhone. An installed encrypted DNS profile, or an app that sets one, can take precedence over the VPN's DNS. Turn it off while the VPN is on, or let the VPN manage DNS.
Android. Open Settings, Network and internet, Private DNS (the path varies a little between manufacturers). If a specific provider is set, lookups go there instead of the VPN's resolver. Choose Automatic or leave DNS to the VPN, and enable Always-on VPN with Block connections without VPN.
Browser. Firefox, Chrome, Edge and Brave can use their own secure DNS (DNS over HTTPS), which bypasses the system and the VPN. The test then sees your browser's DoH provider rather than the VPN's resolver. If you want the VPN to decide, switch secure DNS off in the browser's privacy settings.
Router. Some routers intercept every DNS query on the home network and hand it to the provider's resolver, whatever you configured. If the leak appears only at home and disappears on mobile data, the router is the likely cause.
WebRTC powers video calls in the browser. To connect two people it has to discover every address each of them can be reached on, and it does so by asking a STUN server. Any web page can trigger that with a few lines of JavaScript and no permission prompt. If the VPN does not route those requests, the STUN server sees your real address and the page reads it. Modern browsers hide local network addresses behind random names ending in .local, so you will rarely see them. The public address is what counts, and it should match the VPN's.
IPv6 is the newer addressing scheme, now enabled on many fibre and mobile connections. Several VPNs encrypt only IPv4: if your line has IPv6 and the VPN ignores it, sites reachable over IPv6 see your real address. The test tries to reach a service available only over IPv6 and tells you whether it succeeds and from which network.
The test runs in your browser. To see your resolvers it uses domain names served by ipleak.net, a public service built for this purpose: your browser looks up a random name and ipleak.net answers with the addresses of the resolvers that asked for it. Your public address and provider name come from ipwho.is; each resolver's network comes from Team Cymru's IP-to-ASN mapping, queried through Cloudflare's DNS over HTTPS. The IPv6 check uses ipify and the WebRTC check Cloudflare's public STUN server.
Those services see the request the way any website you visit would. We never receive the results: there is no server of ours collecting them and nothing is stored. If one of the services is blocked by your own protection, the test says so instead of guessing.
Technical terms used on this page, briefly explained.
Laws, official tables and reference implementations the logic of this tool was checked against.
I am Maurizio Fonte, a software engineer with more than twenty years in networks, servers and security. I built this test because the ones I found showed addresses without explaining them: I wanted a verdict anyone could understand.
About meI reply within 2 working days, within 24 hours for technical emergencies. The first discovery call lasts an hour, is free and not binding. By the end I'll tell you clearly whether I can help, or point you to someone who can do it better than me.
Get in touch