How to Check if Your VPN Is Leaking Your IP, DNS or WebRTC

You connect your VPN, the app says "protected", and you assume your real IP address is hidden. Usually it is — but not always. A leak means some of your traffic or lookups still go around the VPN tunnel and reveal your real IP address, your ISP or the sites you visit. It takes only a few minutes to check, and you already have the main tool: the Show-IP.ir lookup shows exactly what a website sees.

The three kinds of leak

• IP leak. Your real public IP address is visible to websites. The usual causes are IPv6 traffic that the VPN does not cover, or the VPN dropping while the apps keep running.
• DNS leak. The VPN carries your traffic, but your device still asks your ISP's DNS server for the addresses of the sites you visit, so the ISP (and anyone watching that resolver) can see your browsing. See what DNS is.
• WebRTC leak. A browser feature used for video calls can be asked by a web page to reveal your local and sometimes real public IP addresses, even when a VPN is running.

Step 1: Record your normal IP (VPN off)

With the VPN disconnected, open Show-IP.ir and note three things: the IP address, the country and the ISP / ASN. This is your real fingerprint, the one you want to hide.

Step 2: Connect the VPN and check again

Connect to a server, then reload Show-IP.ir (use a hard refresh). Now compare:

• The IP address should be different.
• The country should match the server location you picked.
• The ISP / ASN should be the VPN company or a datacenter, not your own ISP.
• The Security status section may now flag it as a VPN / datacenter / proxy. That is the expected result — see proxy vs VPN vs Tor.

If you still see your own IP, ISP or country, the VPN is not protecting that traffic. Reconnect, try another protocol or server, and check that the app is actually connected.

Step 3: Check for an IPv6 leak

Many networks have both IPv4 and IPv6 (IPv4 vs IPv6). Some VPNs tunnel only IPv4, so a site that supports IPv6 is reached directly, outside the tunnel. If Show-IP.ir shows a long IPv6 address that belongs to your own ISP while the VPN is on, you have an IPv6 leak. The fixes are to enable IPv6 protection in the VPN app, choose a VPN that supports IPv6, or disable IPv6 on your network adapter.

Step 4: Check for a DNS leak

Run this in a terminal (Windows Command Prompt, macOS or Linux) with the VPN connected:

nslookup whoami.akamai.net

The address returned is the DNS resolver that made the request on your behalf. Look that address up in any WHOIS or IP-lookup service. If it belongs to your normal ISP while the VPN is on, your DNS queries are leaking. If it belongs to the VPN provider or a public resolver you chose, you are fine. You can also use a dedicated DNS-leak test website, which does the same thing with more detail.

To fix it: turn on "DNS leak protection" in the VPN app, set a DNS server manually on your device (how to change DNS), or use encrypted DNS (DoH/DoT).

Step 5: Check for a WebRTC leak

Open a WebRTC leak test page in your browser with the VPN on. If it lists a public IP address that is your real one, the browser is exposing it. Ways to reduce this:

• Firefox: set media.peerconnection.enabled to false on the about:config page (this turns off WebRTC, so video-call sites will stop working).
• Brave: Settings → Privacy and security → WebRTC IP handling policy.
• Chrome and other browsers: they have no simple built-in switch; use a trusted extension that limits WebRTC or the VPN's own browser extension.

Step 6: Test the kill switch

A kill switch blocks all internet traffic if the VPN connection drops, so nothing leaks while it reconnects. Turn it on in the app, then simulate a failure (for example briefly disable and re-enable your Wi-Fi) while a page is loading. Traffic should stop rather than continue on your real connection.

Why leaks happen

• The VPN does not handle IPv6 or custom DNS.
• "Split tunnelling" is on, so some apps deliberately bypass the VPN.
• The browser has WebRTC enabled, or a browser extension makes its own network requests.
• The VPN reconnected silently, or the app lost permission after an operating system update.

What a VPN still cannot hide

Even a perfectly sealed VPN does not hide who you are when you log in, nor the cookies and browser fingerprint your device sends. For realistic expectations read how a VPN changes your IP, whether an IP can reveal your location and how to hide your IP.

Key takeaways

• Compare your IP, country and ISP on Show-IP.ir with the VPN off and on; all three should change.
• Look separately for IPv6, DNS and WebRTC leaks — a VPN can pass the IP test and still leak DNS.
• Enable the VPN's kill switch and leak protection, and recheck after updates.
• A leak-free VPN hides your IP, not your identity.