Privacy diagnostics

VPN Leak Testing Guide: IP, DNS, WebRTC & IPv6

A VPN that hides your IPv4 but leaks IPv6, DNS, or WebRTC isn't actually private. Use this guide to test every channel that can deanonymize a tunneled connection and harden what's exposed.

Run a VPN leak test

Quick summary

  • Test IPv4, IPv6, DNS, and WebRTC in the same session.
  • Compare your public IP outside vs inside the tunnel.
  • Confirm your DNS resolver is operated by the VPN, not your ISP.
  • Re-test after every VPN, browser, or OS update.

The four leak channels that matter

  • IPv4 leak — your real public IPv4 visible to a site.
  • IPv6 leak — IPv6 routed outside the tunnel.
  • DNS leak — DNS queries handled by your ISP instead of the VPN.
  • WebRTC leak — browser ICE candidates exposing your real IP.

How to interpret a leak result

A clean test should show your VPN's public IP for both IPv4 and IPv6, a DNS resolver run by the VPN provider (not your ISP), and no WebRTC candidate matching your real IP. Any mismatch is a leak — even if only one channel fails.

Hardening steps after a leak

  • Enable the VPN client's kill switch.
  • Disable WebRTC in your browser or use a hardening extension.
  • Force IPv6 routing through the tunnel, or disable IPv6 entirely.
  • Set custom DNS to your VPN's resolver in the OS.

Troubleshooting workflow

Run through these steps in order. Each step links to the right diagnostic tool.

  1. 1

    Run the leak test

    Get a single score across IP, IPv6, DNS, and WebRTC.

    Open VPN Leak Test
  2. 2

    Confirm your IP details

    Cross-check geolocation, ASN, and reverse DNS for the IP your VPN exposes.

    Open IP Details
  3. 3

    Audit DNS resolver

    Verify the resolver answering your queries is the one you expect.

    Open DNS Lookup
  4. 4

    Check headers exposure

    Confirm no leaked client hints or forwarded headers reveal your real network.

    Open Headers Audit
  5. 5

    Monitor privacy over time

    Save scans to track regressions after updates.

    Open Dashboard

Recommended next steps

VPN Leak Test

IP Details

DNS Lookup

Security Headers

Browser fingerprint

What is my IP address

Frequently asked questions

What's the most common VPN leak?

WebRTC. Browsers expose local and public ICE candidates to any page that asks, completely bypassing the VPN tunnel.

Does my VPN protect against DNS leaks by default?

Most modern VPNs route DNS through the tunnel, but split-tunneling, IPv6, and OS-level overrides can still leak. Always verify.

Should I disable IPv6 to prevent leaks?

Only if your VPN doesn't tunnel IPv6. The better fix is a VPN that handles both stacks; disabling IPv6 is a workaround, not a solution.

How often should I re-test?

After every OS update, browser update, or VPN client update. Network stack changes are the most common cause of new leaks.

Monitor it continuously

Save this check, get alerts on changes, and track multiple domains in one dashboard.

Learn about monitoring