Privacy
How to Check If Your VPN Is Leaking (DNS and WebRTC Leaks Explained)
·8 min read·JaguarVPN Team
You connect to a VPN, the app turns green, and you assume you are covered. Most of the time you are. But "connected" and "not leaking" are two different things, and the gap between them is where people get caught out.
A leak means some part of your traffic is taking a different road than the tunnel. Your VPN is still running. The app still says connected. Something just isn't using it. The two that matter most for ordinary users are DNS leaks and WebRTC leaks, and you can check both in about two minutes.
Here's how to test properly, how to read the result, and what to actually do if something comes back wrong.
The quick version
Run three checks, in this order:
- Check your IP. It should be the VPN's, not your ISP's.
- Check your DNS. The resolver answering your lookups should belong to the VPN, not your home provider.
- Check WebRTC. Your browser should not be volunteering a second address.
If all three agree, you are fine. If your IP looks right but DNS or WebRTC shows something else, that is a leak, and it is worth fixing before you carry on.
You can run all three from our free tools page — What Is My IP, the DNS leak test, and the WebRTC leak test. Nothing to install.
Test one: does your IP actually change?
Load What Is My IP twice — once with the VPN off, once with it on. Write down both.
With the VPN off you'll see your real address and your ISP's name. With it on, both should change. If the ISP line still says your home provider while the VPN claims it's connected, the tunnel isn't carrying your browser traffic at all. That is usually split tunnelling doing exactly what it was told, and we cover how that works in split tunnelling explained.
One thing that trips people up: the city is often wrong even when everything is working correctly. Geolocation databases map an address block to a place, and they are frequently out of date by a town or two. A wrong city is not a leak. A wrong ISP is.
Test two: DNS, the one almost everyone misses
Every time you type a domain name, your device asks a resolver to turn it into an address. That lookup is a separate request from the page load itself, and it can quite happily go somewhere else.
If your device keeps using your ISP's resolver while the rest of your traffic goes through the tunnel, your provider still gets a list of every site you visit, in order, with timestamps. They don't see the pages. They see the names, which for most purposes is the same thing. Our piece on what your ISP can actually see goes through the distinction properly.
Run the DNS leak test with the VPN on and look at who answered.
A pass looks like: one or two resolvers, all belonging to the VPN provider or a resolver it routes to, in a location consistent with your VPN server.
A leak looks like: your own ISP's name in the resolver list. BT, Comcast, Jio, PTCL, whoever supplies your line. If their name appears while you are connected, your lookups are escaping.
The awkward middle case: you see a big public resolver like Google or Cloudflare that you configured yourself. That is not your ISP, so it is better, but those queries may still be going out over your normal connection rather than through the tunnel. It is worth checking rather than assuming.
If you want the underlying detail, what is a DNS leak covers the mechanics, and how DNS works explains the lookup itself.
Why this happens
Usually one of four things:
- The operating system ignored the VPN's resolver. Windows in particular has a long history of querying several resolvers at once and using whichever replies first, which is fast and completely wrong for privacy.
- A browser is doing its own DNS. Chrome and Firefox both ship encrypted DNS that bypasses the system resolver entirely. That protects the query from your ISP, but only if the query is going through the tunnel.
- IPv6. Plenty of VPN setups route IPv4 carefully and leave IPv6 unclaimed. On a dual-stack connection — most home and mobile networks now — anything that can use IPv6 does, and it goes around the tunnel. Encrypted DNS transports like DNS over HTTPS and DNS over TLS don't help here, because the problem isn't the query being readable, it's the route it takes.
- A resolver hard-coded somewhere. Router, device settings, or an app that ships its own.
A VPN worth using handles DNS inside the tunnel by default, so you don't have to think about any of that.
Test three: WebRTC, the browser's own back channel
WebRTC is the technology behind in-browser video calls, voice chat and screen sharing. To connect two people directly, it needs to work out what addresses each machine can be reached on — and it asks the operating system directly, using a mechanism called ICE.
That's the problem. Those candidate addresses are gathered outside the normal request path, so a page can sometimes learn an address your VPN was supposed to be hiding. It has been a known quirk of the WebRTC API for years, and it is not a bug so much as the feature working as designed.
Run the WebRTC leak test with the VPN on.
A pass: either no public address at all, or the same address the VPN gave you.
A leak: a second public address that matches what you saw with the VPN switched off. Local addresses starting 192.168. or 10. are not a leak — those are private and meaningless outside your own network.
There's more background in what is a WebRTC leak.
Fixing it
In Firefox, type about:config in the address bar, accept the warning, search for media.peerconnection.enabled and set it to false. That switches WebRTC off completely, which also breaks browser video calls, so turn it back on when you need Meet or Discord in a tab.
Chrome has no equivalent switch. You'll need an extension that restricts WebRTC's address handling, and you should be picky about which one — a browser extension can see everything you do, so install one with a real user base and a named developer rather than the first result.
Simplest option: use a different browser for calls than for everything else.
What to do when a test fails
Work through it in this order. Most leaks are gone by step three.
1. Reconnect, then retest. Genuinely worth doing first. A tunnel that dropped and reconnected can leave the system resolver pointed somewhere stale.
2. Turn on the kill switch. This blocks traffic entirely whenever the tunnel isn't up, so a two-second drop can't quietly send anything down your normal connection. What a VPN kill switch is explains the trade-offs — including that it will cut your internet if the VPN fails, which is the whole point.
3. Check your split tunnelling list. If the browser or a specific app is excluded, everything it does is outside the tunnel by design. Easy to set months ago and forget.
4. Disable the browser's own encrypted DNS temporarily and retest. If the leak disappears, you've found it, and you can decide which setting you'd rather keep.
5. Retest on a different network. Some hotel, campus and corporate networks intercept DNS at the gateway and answer it themselves, no matter what your device asks for. If the leak follows you to mobile data, it's your device. If it doesn't, it's that network. Our guide to staying safe on public Wi-Fi covers what else those networks do.
6. Change protocol. Some networks interfere with VPN traffic specifically, and a connection that keeps dropping is a connection that keeps leaking during each gap.
That last point is where the choice of connection mode matters. In the JaguarVPN app, Aurora is the everyday default — quick to connect, low latency, right for streaming and daily browsing. MIRAGE is the one to reach for on networks that actively block VPNs: hotel Wi-Fi, some campus networks, and countries that filter aggressively. It trades some raw speed for staying up where an ordinary connection would be cut, and a tunnel that stays up is a tunnel that isn't leaking between reconnects.
How often should you check?
Not obsessively. Realistically:
- After installing or updating your VPN app
- After a major operating system update, because these reset network settings more often than you'd expect
- The first time you connect on a network you don't control
- If you start seeing more CAPTCHAs than usual, or sites behave as though you're somewhere you're not
What these tests don't tell you
A clean result means your traffic is taking the route it should. It does not make you anonymous.
You can pass every leak test and still be identified by the account you logged into, by cookies you already carry, or by browser fingerprinting, which recognises the specific combination of your screen size, fonts, timezone and graphics hardware without needing your address at all.
A VPN moves your traffic and hides your address from the networks in between. That's a real, useful thing. It is not the same as being invisible, and anyone who tells you otherwise is selling something. The EFF's Surveillance Self-Defense guide is the best free starting point for working out what you actually need to protect, and from whom.
Start with the three tools. Two minutes, and you'll know instead of assuming.