How to Test if Your VPN Leaks in 2026: DNS, WebRTC and IPv6 Guide

You've turned on your VPN, the indicator is green, you think you're protected. Bad news: roughly one in five VPN connections leaks at least one piece of identifying information that reveals your real online identity. In this guide, you'll learn how to test your VPN in under 5 minutes, spot the four most common types of leaks, and fix them.

Why can a VPN leak?

A VPN creates an encrypted tunnel between your device and a remote server. In theory, all your traffic goes through that tunnel. In practice, several mechanisms can bypass the tunnel:

• DNS requests can go to your ISP instead of the VPN
• WebRTC, used by browsers for video calls, can expose your real IP
• IPv6 is often ignored by poorly configured VPNs
• The kill switch may not trigger during a brief network drop

Every leak breaks the VPN's promise. The good news: knowing is fixing.

Before you start: the basic check

1. Go to whatismyipaddress.com with your VPN off and note your IP and country
2. Turn on your VPN and connect to a server in another country
3. Reload the same page

If your IP and country have changed, the basic layer works. Time for real tests.

Test 1: DNS leak

What is a DNS leak? When you type google.com, your device asks a DNS server for the matching IP address. If that request goes to your ISP's DNS instead of the VPN's resolver, your ISP sees your entire browsing history even with the VPN on.

How to test:

• Go to dnsleaktest.com
• Click Extended test
• Look at the listed DNS servers

How to read the result:

• ✅ Listed servers belong to your VPN (SandVPN, Cloudflare, Quad9 forced by the VPN)
• ❌ A server belongs to your ISP (Comcast, AT&T, BT, Orange…): DNS leak confirmed

How to fix:

• Enable "Force DNS" or "DNS leak protection" in your VPN client
• On Windows, disable "Smart Multi-Homed Name Resolution" in group policy
• As a last resort, manually set your system DNS to 1.1.1.1 or 9.9.9.9

Test 2: WebRTC leak

What is a WebRTC leak? WebRTC is an API that Chrome, Firefox and Edge use for video calls. It can query your router for your local and public IP, completely bypassing the VPN at the browser level.

How to test:

• Go to browserleaks.com/webrtc
• Check the "Public IP Address" and "Local IP Address" fields

How to read:

• ✅ Public IP matches the VPN server
• ❌ Public IP is your real IP or your ISP's IP: WebRTC leak

How to fix:

• Chrome/Edge: install the "WebRTC Network Limiter" extension
• Firefox: about:config → media.peerconnection.enabled → false
• Brave: Settings → Shields → "WebRTC IP Handling" → "Disable Non-Proxied UDP"
• Use a VPN that blocks WebRTC at the OS level, not just in-browser

Test 3: IPv6 leak

What is an IPv6 leak? Many VPNs tunnel IPv4 but forget IPv6. If your ISP assigns you an IPv6 address (now standard in most countries), IPv6 traffic can escape the tunnel and reveal your location.

How to test:

• Go to ipv6leak.com or ipv6-test.com
• Run the automatic test

How to read:

• ✅ Result shows "No IPv6 address detected", or the IPv6 shown is the VPN's
• ❌ A public IPv6 different from the VPN server: IPv6 leak

How to fix:

• Enable "IPv6 leak protection" in your VPN client
• Otherwise disable IPv6 in your Windows, macOS or Linux network settings
• Ideally, pick a VPN that tunnels IPv6 natively instead of just disabling it

Test 4: Does your kill switch actually work?

The kill switch cuts your internet connection if the VPN drops. In theory. To really test it:

1. Start a video stream or a download
2. Force-kill the VPN process from Task Manager (don't click "Disconnect" cleanly)
3. Try to load a web page

How to read:

• ✅ No page loads: kill switch working
• ❌ Pages load using your real IP: broken kill switch

This is the most revealing test: many VPNs ship a "cosmetic" kill switch that only reacts to voluntary disconnects.

Test 5: DNS persistence after disconnect

For the truly careful, check DNS persistence after disconnecting the VPN:

• Disconnect the VPN
• Run ipconfig /displaydns (Windows) or sudo killall -HUP mDNSResponder (macOS)
• Some VPN DNS entries can linger in the system cache, leaving a fingerprint on your device

A good VPN client flushes the DNS cache on disconnect.

What to do if you find a leak

1. Restart the VPN client and rerun all tests from scratch
2. If the leak persists, switch protocols: try WireGuard if you were on OpenVPN, or the reverse
3. Still leaking? Contact your provider's support, or consider switching VPNs

Why SandVPN is built leak-free

At SandVPN, every client ships by default with:

• Forced DNS through our no-log resolvers
• WebRTC blocking at the OS level, not just browser
• Native IPv6 tunneling, not a brute disable
• Kill switch tested against real network drops, not simulated ones
• Automatic DNS cache flush on disconnect

Conclusion

An untested VPN is a VPN you hope is safe. In 5 minutes with the tools in this guide, you move from hope to certainty. Rerun these tests after every major update to your OS or VPN client: leaks often appear after a Windows patch or a protocol change on the provider's side.

🔐 Download SandVPN for a leak-proof client configured correctly from first launch.