A DNS leak happens when your device sends domain name lookups outside your VPN tunnel, usually to your ISP's resolver, so your ISP can still see which sites you visit. A WebRTC leak is a related browser problem in which a web page can discover your real IP address even though your VPN or proxy is active.
Both leaks are silent: the VPN shows "connected" and websites see the VPN's IP for normal traffic. This guide explains why each one happens, how to test for it, and how to fix it, along with the closely related IPv6 leak.
What a DNS leak is
Before your browser can connect to www.example.com it has to ask a DNS resolver for the site's IP address. That question, and its answer, reveal which site you are about to visit. If you are new to the lookup process, our guide to how DNS works covers it step by step.
A properly configured VPN sends DNS queries through the tunnel to a resolver run by the VPN provider or one you have chosen. When that fails and queries go directly to your ISP's resolver instead, you have a DNS leak. The website still sees the VPN's IP, but your ISP has a list of every domain you looked up, with timestamps.
Common causes of DNS leaks
- The OS keeps using the old resolver. The VPN client fails to replace the system DNS settings, or another network adapter's DNS server has higher priority.
- Parallel queries on Windows. Windows can send a query to the DNS servers of several network interfaces at once and use the fastest answer, so the ISP's resolver sees the query even if the VPN's resolver also does.
- IPv6 DNS. The VPN handles IPv4 DNS but the system also has an IPv6 resolver from the router, which is used outside the tunnel.
- Split tunnelling. Apps excluded from the VPN resolve names with the normal resolver by design.
- Manual DNS settings on the device or router that override what the VPN sets.
How to test for a DNS leak
Dedicated DNS leak tests work by making your browser look up several random, unique subdomains of a domain whose authoritative server the tester controls. The authoritative server records which resolver IP addresses asked for those names. If any of them belong to your ISP rather than your VPN provider, you have a leak.
You can do a quick version of this from a terminal. Akamai runs a special name that answers with the IP address of the resolver that asked for it:
dig +short whoami.akamai.net
nslookup whoami.akamai.netRun it with the VPN connected, then paste the returned IP into our ASN lookup. If the network belongs to your ISP, your DNS is leaking. Also check which resolvers your system is configured to use:
- Windows:
ipconfig /alland look at "DNS Servers" on every adapter. - macOS:
scutil --dns - Linux with systemd-resolved:
resolvectl status
How to fix a DNS leak
- Turn on the VPN client's DNS leak protection option if it has one. Most current clients force all DNS through the tunnel and block port 53 to other servers.
- Remove manually configured DNS servers on the network adapter, or set them to the VPN's resolver.
- If the VPN does not support IPv6, disable IPv6 on the adapter or turn on the client's IPv6 leak protection.
- Enable the kill switch so nothing, including DNS, leaves the device while the tunnel is reconnecting.
- Retest after every change, and again after reconnecting to a different Wi-Fi network.
What a WebRTC leak is
WebRTC is the browser technology behind video calls and peer-to-peer file transfers. To connect two browsers directly, it has to find every address at which each one might be reachable. It does this through ICE (Interactive Connectivity Establishment), which gathers a list of candidates:
| Candidate type | Where it comes from | Example |
|---|---|---|
| Host | The device's own network interfaces | 192.168.1.23 or an mDNS name |
| Server reflexive (srflx) | A STUN server reports the public IP and port it saw the request come from | 203.0.113.50 |
| Relay | A TURN server that forwards media when a direct path fails | The TURN server's IP |
Any web page can start this process with a few lines of JavaScript, without asking permission, and read the candidates. The leak happens when the STUN request leaves your device outside the VPN or proxy. That is common with browser proxy extensions and SOCKS proxies, which route web requests but not WebRTC's UDP traffic, and with split tunnelling. The server reflexive candidate then contains your real public IP.
mDNS obfuscation of local addresses
Host candidates used to expose private LAN addresses such as 192.168.1.23, which helped fingerprint users. Current versions of Chrome, Firefox, Safari and Edge replace them with random names like 3f1c2a9e-7b4d-4c1e-9a52-6d8e0f1b2c3a.local, resolved through multicast DNS only on the local network. Browsers usually reveal real local addresses only after a page is granted camera or microphone access.
How to test and fix WebRTC leaks
Run our WebRTC leak test with your VPN or proxy active. It lists every candidate your browser exposes. If any public address matches the one you have with the VPN off, you have a leak. To fix it:
- Use a full-tunnel VPN rather than a browser-only proxy. When all UDP traffic goes through the tunnel, the STUN server sees the VPN's IP.
- Firefox: open
about:configand setmedia.peerconnection.enabledtofalse. This disables WebRTC entirely, so video calls in the browser stop working. - Chromium-based browsers: there is no simple user setting, but the
WebRtcIPHandlingenterprise policy (for exampledisable_non_proxied_udp) or a reputable extension can restrict which interfaces WebRTC uses.
IPv6 leaks
Many networks now give devices both an IPv4 and an IPv6 address. If your VPN only creates an IPv4 tunnel, the operating system still has a working IPv6 route through your ISP. Sites that support IPv6 prefer it, so they see your real, globally unique IPv6 address, which is often more identifying than an IPv4 address shared behind NAT.
Test with the VPN connected using our IPv6 connectivity test. You want to see either no IPv6 connectivity or an IPv6 address belonging to the VPN provider. An address from your own ISP's range means a leak; fix it by enabling the client's IPv6 support or leak protection, or by disabling IPv6 on the network adapter while using the VPN.
Frequently asked questions
Can my ISP see my browsing if I have a DNS leak?
It can see the domain names you look up, not the pages or content. The traffic itself still goes through the VPN, so your ISP cannot see what you do on each site.
Do DNS leaks matter if I am not using a VPN?
The term only applies when you expect DNS to go somewhere else. Without a VPN, your ISP's resolver is normally used anyway. You can switch to an encrypted DNS service to keep lookups from your ISP.
Is disabling WebRTC safe?
Yes, it will not break normal browsing, but browser-based video calls, screen sharing and some file-sharing sites will stop working until you turn it back on.
Why does the WebRTC test show a .local address?
That is the browser's mDNS protection working as intended. The random .local name hides your private LAN IP from the website.