What Are VPN Leaks and How Do You Fix Them?

A VPN leak is a security flaw that exposes your IP address, DNS requests, or other personally identifying information to any third party monitoring your internet connection.

When a VPN is described as “leaking,” it means that a portion of your traffic is traveling outside the encrypted tunnel, failing to hide your public IP address and encrypt your internet traffic. That’s a fundamental failure, because it exposes your identity and internet activity.

In my own testing, I’ve found DNS leaks are by far the most common problem I run into, but IP address leaks (including IPv6 leaks) and WebRTC leaks all turn up regularly.

To find whether your VPN is letting you down, run an IP leak test. If you just want to confirm it’s doing the basics, check whether it has actually changed your IP address.

Let’s start with the three types of leak I see most often. There’s a fourth issue to watch out for – HTML5 geolocation – and I cover how to fix that further down.

IP Address Leaks

An IP (Internet Protocol) address identifies devices connected to the internet or a local network, allowing them to find and communicate with one another.

IP addresses also give away a device’s approximate geographical location.

An IP leak occurs when your VPN fails to mask your real public IP address with one of its own. It’s a serious privacy risk, as any websites you visit will be able to see your true location and potentially identify you.

There are two types of IP address, IPv4 and IPv6, and either can leak.

IPv4 leaks are much less common than IPv6 leaks. In fact our Android VPN security research shows that 15% of free Android VPNs tested leaked IPv6 compared to just 3% for IPv4.

Unless your VPN software has built-in IPv6 leak protection, the only reliable fix is to disable IPv6 traffic – either on your device or on your router. Neither is possible at the system level on iOS or Android, which is why I won’t recommend a mobile VPN app that leaks IPv6.

IPv6 leaks are equally as dangerous as IPv4 leaks. Websites still see your real location, and your ISP can track your browsing history.

A premium VPN should include a kill switch to protect your IP address if your connection unexpectedly drops. That safety net is less reliable than it sounds though – when I ran our VPN kill switch tests, many top-tier services still leaked my IP address when I switched servers mid-session.

Learn how to fix IP leaks.

DNS Leaks

DNS (Domain Name System) is often described as the phonebook of the internet. It translates domain names into IP addresses which a browser needs to load websites and other online resources.

Every time you visit a website, your browser follows a sequence of steps in order to request the page you want to view. It first sends a query to a DNS server, which looks up the IP address associated with the domain name of the website. Your browser then contacts that IP address and requests the site.

The same thing happens when you open Netflix, or any other app that connects to the internet.

Normally, your ISP’s DNS servers handle this, and they often log every request alongside your IP address.

A VPN is supposed to encrypt your DNS queries and route them to its own private DNS servers.

The most common DNS leak I find is a VPN that simply never reroutes the DNS requests – leaving them with your ISP’s default DNS servers, or handing them to another third party without your consent.

To see which servers your device is using, run our DNS server test.

Many VPNs will use DNS servers operated by Google, Cloudflare or OpenDNS by default. Over half (57%) of free Android VPNs tested in-house did exactly that.

Consent is the thing that matters here. Pointing your own DNS at a public resolver is a legitimate fix, and I recommend it later in this guide. What I object to is a VPN silently defaulting to it, because you end up putting your trust in a company you never chose – while paying for private DNS servers you aren’t actually using.

Worse still, some VPNs leak DNS requests outside of the tunnel entirely, leaving them exposed to your ISP or anyone else monitoring your internet traffic.

That’s what the Wireshark capture above shows – the Private VPN Android app leaking DNS requests for the Top10VPN website in plain sight. 9% of the free Android VPNs my team tested exposed DNS requests this way.

Look closely at the capture and you’ll also see a stream of DNS requests for ad-tracking domains, such as td.doubleclick.net. Most of the free Android VPNs we tested leaked requests like these. They reveal nothing about you personally, but I treat them as a reliable tell that an app is improperly configured and not completely trustworthy.

DNS leaks also leave you more exposed to DNS poisoning, where an attacker manipulates DNS responses to redirect you to malicious websites or intercept your traffic.

Why do DNS leaks happen?

• VPN service issues: some VPNs may have misconfigured DNS settings at their end, or they don’t operate their own DNS servers at all.
• Incorrect user settings: software updates or manual changes to your network settings can leave your device using the wrong DNS servers.
• Third-party software: other apps installed on your device may alter your DNS settings without you realizing.
• ISP DNS redirection: your ISP may be redirecting DNS queries, bypassing your preferred configuration.
• Malware: malware can change your device’s DNS settings and redirect DNS queries to malicious servers.
• DNS spoofing: An attacker can intercept DNS queries and return false responses.

Learn how to fix DNS leaks.

WebRTC Leaks

WebRTC (Web Real-Time Communication) is an open-source technology that allows web browsers and mobile apps to communicate in real-time. It’s the tech that powers video conferencing, voice calling, and peer-to-peer file sharing without plugins or additional software.

It’s enabled by default in popular browsers such as Chrome, Firefox, and Safari.

A WebRTC leak happens when a VPN fails to stop your IP address and other identifying information from being exposed to websites and third parties. It’s a side effect of the way WebRTC negotiates direct peer-to-peer connections, which is also why it’s as much a browser problem as a VPN one.

Almost one in five (18%) of free Android VPNs we tested leaked through WebRTC.

Learn how to fix WebRTC leaks.

My team and I have tested every one of the 59 VPNs in our review library for IP, DNS, and WebRTC leaks – every service, on every platform it supports.

Some of the most-downloaded VPNs on the Apple and Google app stores leak user data through DNS or WebRTC. The table below lists the most popular leak offenders.

*Leaks detected during testing of Chrome extension.

My team has also recently tested 100 of the most popular free Android VPNs, and the results were worse than expected: 88 of them were leaking. DNS leaks were the most common, exposing the internet traffic of 83 VPN apps, and 17 apps leaked in more than one way.

For the full breakdown of the 100 most popular free Android VPNs and how they performed in our security tests, read our Free Android VPN Security Flaws research report.

If you care about your privacy, choosing a VPN that doesn’t leak in the first place is the simplest and most important decision you can make.

That said, not every leak means starting over. If you’ve tested your VPN and found a problem, you can work through the fixes below.

If a website identifies your IP address as belonging to a data center, that isn’t a leak – it’s a sign your VPN is working, and your real IP address is hidden. The only thing exposed is the fact you’re using a VPN.

IP addresses are classified by how they’re registered. Home and mobile connections are registered to consumer ISPs, so they’re labeled as residential.

VPN servers live in data centers, so their addresses are registered to hosting companies, which is what lookup services report.

This only becomes a problem when a site actively blocks VPN traffic. If that happens to you, don’t reach for the off switch. Try a different server first, then your VPN’s obfuscated (or ‘stealth’) mode, and then a dedicated IP address if your provider sells one.

Turning off your VPN will clear the data center flag, but it also hands your real IP address back to every site you visit.

If you use a VPN while torrenting, it’s worth checking that your BitTorrent client isn’t leaking your IP address separately. Our Leak Tool test has a specific Torrent Leak Test option for this. I’ve seen these types of leak happen on setups where the VPN was working perfectly for browsing and for every other app.

Torrent IP leaks come from two sources: TCP and UDP – either protocol can be used when downloading a file via torrent. TCP leaks are the ones you’re realistically going to run into, so start there. The same three fixes also cover UDP.

How to Fix a Torrent TCP IP Leak

How to Fix a Torrent UDP IP Leak

UDP leaks are highly uncommon, and all three fixes above apply to UDP unchanged.

One scenario they won’t cover is a VPN that doesn’t support UDP at all. If that’s the case, the only fix is to switch to a better VPN for torrenting.