DNS & WebRTC Leak Test

A VPN hides your traffic — but not always your DNS lookups or your real IP address. This free tool tests whether your browser leaks your IP through WebRTC, checks for IPv6 exposure, and teaches you exactly how DNS leak tests work, how to read the results, and how to fix leaks on every major browser and OS. No signup, no download.

✅ What this page CAN test

WebRTC IP leak — does your browser reveal your real public IP via STUN, even on a VPN?
Local IP exposure — are your LAN addresses visible, or hidden by mDNS?
IPv6 leak — is an IPv6 address exposed that your VPN may not cover?

⚠️ What it CANNOT test (honest scope)

True DNS-resolver leaks — seeing which DNS servers answer your queries requires a server that watches the queries arrive. A static page cannot do that.
For that part, use a server-side test such as dnsleaktest.com or ipleak.net — then come back here to check the WebRTC vector.

Run the WebRTC & IP leak test

Click below. Your browser will gather WebRTC connection candidates (up to ~7 seconds) using one STUN request — the same mechanism websites use to discover your IP.

Optional — paste the IP your VPN app shows (for an automatic leak / no-leak verdict):

Privacy: this page makes no network requests of its own — no analytics, no CDNs, no fonts. The test itself sends STUN binding requests to Google's public STUN server (stun.l.google.com), which will see your IP address; that is inherent to how the test discovers your public IP. Nothing is uploaded, logged, or stored by us. You can verify this in your browser's DevTools network tab.

How to read your results

Public IP (server-reflexive): the public address STUN sees. On a VPN it should match the exit IP your VPN app displays. If it shows your real ISP address instead, WebRTC is leaking past the VPN.
Host candidates: addresses of this device. Modern browsers show xxxx.local (mDNS) instead of real LAN IPs — that is correct behavior, not a bug.
Real LAN IPs (192.168.x.x, 10.x.x.x): a minor leak — sites can fingerprint your local network. Updating the browser usually enables mDNS hiding.
IPv6 candidates: if any appear while your VPN only handles IPv4, your real IPv6 address may leak. Disable IPv6 or use a VPN with IPv6 support.
No candidates at all: STUN/UDP is blocked (VPN, firewall, or extension). Blocked STUN means WebRTC cannot leak — but WebRTC calls may break too.

What is a DNS leak, exactly?

Every site you visit starts with a DNS lookup: turning example.com into an IP address. Whoever answers that lookup sees every domain you visit. A VPN encrypts your traffic, but if your system still sends DNS queries to your ISP's resolvers — outside the VPN tunnel — your ISP keeps a full log of your browsing. That is a DNS leak.

Leak type	What it exposes	How to test
DNS leak	The domain names you look up	Server-side test (dnsleaktest.com, ipleak.net) — compare resolvers with VPN on vs off
IP leak	Your real public address	Compare your visible IP with VPN on vs off
WebRTC leak	Real/local IP via the browser	The test above on this page
IPv6 leak	Your real IPv6 address	This page (WebRTC candidates) + `test-ipv6.com`

Fixing one does not fix the others — check all of them. A common workflow: baseline test with the VPN disconnected (note your real IP and resolvers), connect the VPN, then re-run every test.

Standard vs extended test

On dnsleaktest.com you get two buttons. The Standard test performs 1 round of 6 DNS queries — fast, and usually enough to discover a leak. The Extended test performs 6 rounds of 6 queries (36 total). It takes 10–30 seconds longer but is more likely to reveal every resolver involved, including load-balanced ones that only answer occasionally. If you have strong privacy requirements, run the extended test to be certain.

DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and leaks

DoH and DoT encrypt your DNS queries so nobody on the network path can read or tamper with them — but encryption is not the same as routing. If your browser uses DoH to Cloudflare while your VPN expects its own resolver, the queries are encrypted yet still go to a party you did not choose. Conversely, enabling DoH to a trusted resolver is a legitimate fix for ISP snooping even without a VPN. Check chrome://settings/security (Chrome/Edge "Use secure DNS"), Firefox about:preferences#privacy → "Enable DNS over HTTPS", and make sure the browser setting agrees with your VPN's DNS policy instead of fighting it.

Stop WebRTC leaks — per browser

Chrome (desktop)

Local-IP hiding via mDNS is on by default (chrome://flags/#enable-webrtc-hide-local-ips-with-mdns) — leave it on.
There is no built-in WebRTC off switch. Use an extension that sets the WebRTC IP handling policy to "Disable non-proxied UDP".
Advanced: launch with --force-webrtc-ip-handling-policy=default_public_interface_only.

Microsoft Edge

edge://flags → enable "Anonymize local IPs exposed by WebRTC".
Like Chrome, full disabling needs an extension set to "Disable non-proxied UDP".

Firefox

mDNS hostname obfuscation is on by default on desktop.
Balanced fix: about:config → media.peerconnection.ice.default_address_only → true (keeps video calls working).
Nuclear option: media.peerconnection.enabled → false (breaks Meet/Discord web calls).
Note: Android Firefox does not yet obfuscate local IPs with mDNS.

Safari

Safari restricts WebRTC IP enumeration by default — most users need no action.
Advanced toggles live under the Develop menu → Experimental Features (exact paths change between versions).
Granting a site camera/microphone access necessarily exposes your IP to that site — unavoidable on any browser.

Brave

brave://settings/privacy → WebRTC IP handling policy → Disable non-proxied UDP.

Opera / Tor Browser

Opera: Settings → Privacy & security → WebRTC → Disable non-proxied UDP.
Tor Browser disables WebRTC entirely.

After any change, re-run the test above to confirm the leak is closed.

Fix leaks per operating system

Windows

Teredo tunneling is a classic IPv6 leak source. Disable it as Administrator: netsh interface teredo set state disabled, then reboot.
Prefer your VPN's DNS: in the VPN app, enable DNS leak protection and the kill switch (blocks all traffic if the VPN drops).
Check which DNS you use: ipconfig /all | findstr "DNS Servers".

macOS

Inspect resolvers: scutil --dns. With the VPN connected, you should see only your VPN's resolvers.
Disable IPv6 on an interface (advanced): Network Settings → interface → Details → TCP/IP → Configure IPv6: Off.

Linux

Check: resolvectl status (systemd) or cat /etc/resolv.conf.
Advanced users can add firewall rules (iptables/nftables) dropping DNS traffic that does not go through the VPN interface.
IPv6 can be disabled via sysctl (net.ipv6.conf.all.disable_ipv6=1) if your VPN is IPv4-only — understand the tradeoff first.

Android & iPhone

Run the tests in your mobile browser — a clean desktop result says nothing about your phone.
Android: use the VPN provider's app (not manual IKEv2 profiles) so DNS and kill-switch settings apply; Android 9+ supports Private DNS (DoT) in system settings.
iPhone: VPN apps vary in leak protection — test with the app connected, and prefer providers with a documented iOS kill switch.

DNS leak test guides per VPN

The method is the same for every provider — only the settings screens differ:

Disconnect the VPN. Run a server-side test (dnsleaktest.com → Extended) and note your real resolvers/IP — this is your baseline.
Connect to a VPN server (ideally in another country, so leaks are obvious).
In the VPN app, enable DNS leak protection (sometimes called "private DNS") and the kill switch.
Re-run the extended test plus the WebRTC test on this page. Only your VPN's resolvers and exit IP should appear.

NordVPN

Enable Threat Protection and the kill switch in settings; NordVPN routes DNS through its own resolvers by default. Then run the extended test — results should show NordVPN infrastructure, never your ISP.

Surfshark

Turn on CleanWeb and the kill switch; Surfshark uses private DNS on its servers. Test with the extended test and compare against your baseline.

ExpressVPN

ExpressVPN runs its own private, zero-knowledge DNS on every server. Enable the Network Lock kill switch, then verify with the extended test.

Mullvad

Mullvad publishes its own connection check tool on its website — use it alongside dnsleaktest.com. Its apps include DNS leak protection and multihop; enable lockdown mode for a strict kill switch.

Proton VPN

Proton VPN routes DNS through its own resolvers in all apps. Enable NetShield and the kill switch, then run the extended test to confirm no ISP resolvers appear.

PIA (Private Internet Access)

In settings enable PIA MACE and DNS leak protection, plus the advanced kill switch. Re-test and confirm only PIA resolvers answer.

Using Astrill, CyberGhost, IVPN, TorGuard, OVPN, PureVPN, hide.me, Norton VPN, or any other provider? The same 4 steps apply: find the "DNS leak protection" and "kill switch / firewall" toggles in the app's settings — most reputable providers have both — then verify with an extended test. Note: HTTP/SOCKS proxies generally do not intercept WebRTC traffic, so proxy users should pay extra attention to the WebRTC test above.

We do not take VPN affiliate commissions and link to no VPN sellers on this page — the advice above is the same regardless of which provider you use.

DNS leak checks from the command line

Prefer the terminal? These cover the same ground without a browser:

# Which DNS servers is this machine using?
cat /etc/resolv.conf            # Linux (classic)
resolvectl status               # Linux (systemd-resolved)
scutil --dns                    # macOS
ipconfig /all | findstr "DNS Servers"   # Windows

# Scriptable leak check (queries a test service over HTTPS):
curl -s https://dnsleaktest.co.uk/txt

# What public IP does a resolver see for you?
nslookup myip.opendns.com resolver1.opendns.com
dig +short myip.opendns.com @resolver1.opendns.com

CLI checks confirm configuration; the browser-based tests on this page confirm behavior. Use both. (Container users: tools like Gluetun print a DNS-leak check report in their logs — read it after every config change. Torrent users: ipleak.net offers a torrent-address detection check, since torrent clients can leak independently of the browser.)

Troubleshooting

The test shows Cloudflare (1.1.1.1)

That usually means your system or browser is set to Cloudflare's public DNS — or your VPN routes DNS through Cloudflare. It is not a leak by itself; it only matters if it contradicts what your VPN promises (e.g. "private DNS on every server"). Decide which resolver you want, then make the OS, browser, and VPN agree.

Results look obfuscated (`.local` names)

That is mDNS privacy protection doing its job (see FAQ). Your real LAN IPs are hidden — the desired outcome.

Test not working / incomplete / no candidates

Some VPNs and firewalls block UDP/STUN entirely — the test cannot gather candidates, which also means WebRTC cannot leak. That is a result, not a failure.
Extensions that manage WebRTC (privacy extensions, some ad blockers) can interfere — try a fresh profile.
Corporate networks often block STUN; test from a network you control.

Is dnsleaktest.com down?

We cannot monitor third-party uptime from a static page. If it does not load, try the alternatives in the comparison table below (ipleak.net, browserleaks.com) — and this page's WebRTC test keeps working regardless, since it only needs a STUN server.

This tool vs the alternatives

No single site covers everything — that is why privacy guides recommend running two or more tests. Factual comparison (features as publicly documented, October 2026):

Feature	This page	dnsleaktest.com	ipleak.net	browserleaks.com
True DNS-resolver test (server-side)	No — static page cannot do this (see honest scope)	Yes — Standard (6 queries) / Extended (36)	Yes	Yes — 50-query burst
WebRTC leak test	Yes — with automatic VPN-IP comparison and plain-language verdicts	No	Yes	Yes — raw ICE data
IPv6 leak visibility	Yes	—	Yes	Yes
Torrent IP check	No	No	Yes	No
Per-browser fix guides	Yes (Chrome, Edge, Firefox, Safari, Brave, Opera)	No	No	No
Signup / download	None	None	None	None
Page's own network requests	STUN only (disclosed above)	Normal site traffic	Normal site traffic	Normal site traffic

Sites change over time; verify before relying on any single one. We link competitors directly because a trustworthy answer matters more than keeping you on this page.

Frequently asked questions

What is a DNS leak test?

A DNS leak test checks whether your DNS queries — the lookups that turn domain names into IP addresses — travel outside your VPN tunnel to your ISP's servers. If they do, your ISP can see every site you visit even while the VPN is on. A true DNS leak test needs a server: it asks your device to resolve unique test domains and watches which DNS servers show up to answer.

How does a DNS leak test work?

Server-based tests like dnsleaktest.com send your browser a series of unique domain names to resolve. Your system resolves them through whatever DNS server it currently uses. The test's own authoritative name server then reports which resolvers asked for those names. If the resolvers belong to your ISP instead of your VPN provider, you have a DNS leak.

What is the difference between a standard and an extended DNS leak test?

On dnsleaktest.com, the Standard test runs 1 round of 6 DNS queries — fast and usually enough to spot a leak. The Extended test runs 6 rounds of 6 queries (36 total), which takes 10–30 seconds longer but is more likely to reveal every resolver involved, including load-balanced ones.

Is a DNS leak test safe?

Yes. A leak test only observes which servers handle your DNS queries or which IPs your browser exposes via WebRTC. It does not install anything, and reputable tests do not require personal information. Our test runs in your browser; the only network contact is the STUN request the test itself needs, and nothing is uploaded or stored.

What is a WebRTC leak?

WebRTC is the browser technology behind video calls and peer-to-peer connections. To set those up, the browser gathers network addresses (ICE candidates) — including your public IP via STUN. A website can trigger this and read your real IP even when your VPN is connected, because STUN runs over UDP and can bypass the VPN tunnel.

What is an IPv6 leak?

An IPv6 leak happens when your VPN tunnels IPv4 traffic but your system still sends traffic — including DNS queries — over IPv6 outside the tunnel. Windows often prefers IPv6, so if your VPN only supports IPv4, your real IPv6 address can be exposed. The fix is a VPN with IPv6 support or disabling IPv6.

How do I check for DNS leaks?

1) Disconnect your VPN and run a server-side test (e.g. dnsleaktest.com) to record your baseline resolvers. 2) Connect your VPN. 3) Run the extended test. If only your VPN provider's resolvers appear, you are clean; if your ISP's resolvers appear, you have a leak. Also run the WebRTC test on this page to check the browser vector.

How do I read DNS leak test results?

Look at who owns the listed DNS servers. Good: servers belonging to your VPN provider, or in the same country as your VPN server. Bad: servers belonging to your real ISP or in your real location. For WebRTC results: your public IP should match your VPN's exit IP; anything else is a leak.

How long does a DNS leak test take?

A standard test takes a few seconds; an extended test (36 queries) takes roughly 10–30 seconds longer. The WebRTC test on this page gathers candidates for up to 7 seconds.

Why does my DNS leak test show Cloudflare?

Seeing Cloudflare (1.1.1.1) usually means your system or browser is configured to use Cloudflare's public DNS — or your VPN routes DNS through Cloudflare. That is not a leak by itself; it becomes a problem only if those are not the resolvers you intended (for example, your VPN promises its own private DNS).

Can I run a DNS leak test on Android or iPhone?

Yes. Open a leak-test page in your mobile browser. Keep in mind mobile browsers behave differently: Android Firefox, for example, does not yet hide local IPs with mDNS the way desktop Firefox does, and iOS restricts some WebRTC behavior. Test each device separately — a clean result on one device says nothing about another.

What is the difference between a DNS leak, an IP leak, and a WebRTC leak?

A DNS leak exposes the domain names you look up; an IP leak exposes your real public address; a WebRTC leak is a browser-specific way your real or local IP can be revealed even behind a VPN. Most privacy guides recommend checking all three, because fixing one does not fix the others.

Do I need to download an app to test for DNS leaks?

No. Reputable leak tests are web pages — no download, APK, or signup needed. Be cautious of random "DNS leak test APK" downloads; they are a common malware lure. Everything on this page runs in your browser.

My results look obfuscated (.local names). Is the test broken?

No — that is mDNS obfuscation working correctly. Modern Chrome, Edge, and Firefox replace your real local IP addresses with random .local hostnames in WebRTC candidates. It means your LAN addresses are hidden, which is the desired behavior.

What should I do if my VPN is leaking?

Enable DNS leak protection and the kill switch in your VPN app's settings, make sure the app is up to date, and re-test. If leaks persist, check the per-browser fixes (WebRTC) and OS guides (IPv6/Teredo) above, or consider a provider that routes DNS through its own resolvers by default.