A WebRTC leak happens when your browser hands a website your real IP address through its real-time communication feature, even though your web traffic goes through a VPN or proxy. A DNS leak happens when your device asks your internet provider, and not your VPN or proxy, to look up the sites you visit. Both can undo the privacy you thought a VPN or proxy gave you.
What does a VPN or proxy actually change?
A VPN or proxy changes the route your web traffic takes, so the site sees the VPN’s or proxy’s address and not yours. That is only part of what a browser does. Two other things happen alongside normal page loads:
- Your browser looks up site names through DNS.
- Some pages use WebRTC, a browser feature for live audio, video and direct connections, which finds addresses by its own method.
If either of these takes a different route from your page loads, it can expose information the VPN or proxy was meant to hide.
What is a WebRTC leak?
WebRTC lets two browsers connect directly, for example in a video call. To find the best path, the browser collects a list of possible addresses, called ICE candidates, and hands them to the page’s script. The browser asks a STUN server what address it appears to have from the outside, and that answer becomes one of the candidates (MDN: WebRTC connectivity).
The standard that governs this, RFC 8828, describes three ways the list can reveal more than a normal web request:
- With some VPN setups, WebRTC can discover the internet provider’s address behind the VPN, not only the VPN’s address (section 3.4.1).
- Behind a router, private network addresses can be learned (section 3.4.2).
- With a proxy, the STUN check can bypass the configured proxy and reveal the client’s public address when direct internet access is allowed (section 3.4.3).
A site only needs a few lines of script to read this list. You don’t have to start a call.
What is a DNS leak?
DNS is the system that turns a name like example.com into an address. Every site you visit starts with a lookup. If a VPN or proxy sends your page loads one way but your device sends the lookups to your internet provider’s DNS server, the provider can see which sites you visit, even though it can’t see the content. The sites themselves may also see where the lookup came from, depending on how it was done.
Leaks usually come from settings that bypass the tunnel, such as the operating system’s own DNS choice, or from an application that does its own lookups.
How do the two leaks differ?
| WebRTC leak | DNS leak | |
|---|---|---|
| Who sees it | The website you are on | Your internet provider, and sometimes the site |
| What it shows | Your real public and sometimes private IP address | The names of the sites you visit |
| Where it happens | Inside the browser | In the system or the app doing the lookup |
| How to check | A WebRTC test page | A DNS leak test page |
How do you test for each?
You can test both in a few minutes. Run each test twice: first with your VPN or proxy off, to note your real address, and then with it on.
- WebRTC: open the BrowserLeaks WebRTC test. If any public address it lists matches your real internet address from the first run, you have a leak.
- DNS: run the extended test at DNSLeakTest. If the servers listed belong to your own internet provider and not to your VPN or proxy provider, DNS is leaking.
- Repeat in each browser or profile you use. Leaks depend on the browser and its settings, and a fix in one doesn’t carry over to another.
How can you reduce the risk?
- For WebRTC: browsers and extensions can limit how much it reveals. Chrome’s extension settings include a
webRTCIPHandlingPolicyoption with four values:default,default_public_and_private_interfaces,default_public_interface_onlyanddisable_non_proxied_udp(Chrome documentation). RFC 8828 also describes a “force proxy” mode that sends WebRTC through the proxy, noting that most HTTP and SOCKS proxies don’t support UDP, so this usually means TCP only and lower call quality (section 5.2). After any change, re-run the test. - For DNS: use a VPN or proxy that handles lookups itself, and check its settings for a “leak protection” or “remote DNS” option. A SOCKS5 proxy can resolve names remotely if the application asks it to. See our guide on SOCKS5 and HTTP proxies.
- For both: test again after every browser update or setting change.
Browsers built for managing several identities usually handle this for you. VANE, for example, routes name lookups for a profile through that profile’s proxy. Whichever tool you use, trust the test result over the settings page.
Frequently asked questions
Does a VPN stop WebRTC leaks?
Not always. Whether a leak happens depends on the VPN setup and the browser. RFC 8828 notes that some VPN configurations let WebRTC find the provider’s address behind the VPN. Test your own setup.
Can a website see my real IP through WebRTC if I use a proxy?
It can, in some setups. The standard notes that the STUN request can bypass a configured proxy when direct internet access is allowed. The only way to know for your browser is to run a test.
Is a DNS leak the same as an IP leak?
No. An IP leak shows your address to the site you visit. A DNS leak shows the names of the sites you visit to whoever runs the DNS server you used.
Should I just turn WebRTC off?
Turning it off removes the risk but breaks video calls and some web apps. Many people limit it instead of removing it. Pick based on what you need, and test afterwards.
How often should I test?
After you change a browser, VPN, proxy or setting, and now and then as a check. It takes a few minutes.
Key takeaways
- A VPN or proxy doesn’t automatically cover WebRTC or DNS.
- WebRTC leaks reveal your address to the site. DNS leaks reveal your browsing to the DNS server.
- Test both with the proxy or VPN on, and compare against your real address.
- Fix, then test again.
Last updated: 2026-10-26. By the VANE Team.