The Full Checklist
- Confirm the VPN app shows "Connected" and note the server location — this is the baseline, not the proof.
- Run a DNS leak test. Results should show your VPN provider's DNS servers, not your ISP's.
- Run a WebRTC leak test. Your browser shouldn't reveal a second, real IP address alongside the VPN one.
- Check your IPv6 status. If your VPN doesn't fully support IPv6, disable it system-wide rather than leaving it exposed.
- Test the kill switch by briefly disconnecting the VPN server — your internet access should stop, not silently fall back to your normal connection.
- Re-check after any app or OS update. Leak behavior can change with a routine update that resets a setting.
Run the two checks that catch the most common leaks, both free and instant.
DNS Leak Test → WebRTC Leak Test →Why Each Step Matters
A VPN's job is to route all of your traffic through an encrypted tunnel, but "all" depends on correct configuration across several separate systems: DNS resolution, browser-level WebRTC connections, and the newer IPv6 protocol. A failure in any one of them can leak identifying information even while the main VPN tunnel works perfectly.
DNS: The Most Common Leak
DNS leaks happen when your device sends domain-lookup requests outside the VPN tunnel, usually to your ISP's own DNS servers. This means your ISP can still see which sites you're visiting even though your actual traffic is encrypted, defeating a large part of the privacy benefit a VPN is meant to provide.
WebRTC: A Browser-Level Leak
WebRTC is a browser feature used for video calls and real-time apps, and it can request your real IP address directly from your network hardware, bypassing the VPN tunnel entirely. This happens at the browser level, so it can leak your IP even when every other part of your connection is correctly routed through the VPN.
IPv6: The Leak Most Checklists Skip
Many VPN services were built around IPv4 and only partially support IPv6, or don't support it at all. If IPv6 isn't explicitly handled, IPv6-capable websites can see your real network address directly, and a leak check that only tests IPv4 will report a clean result even while this leak is active.
Kill Switch: The Backstop for Everything Else
Even a perfectly configured VPN can drop its connection briefly — an unstable Wi-Fi signal, a server restart, a network switch. Without a kill switch, your device typically falls back to your normal internet connection automatically during that gap, sending traffic unprotected for however long the reconnection takes. A kill switch instead blocks all traffic until the VPN tunnel is back up, turning a brief drop into a pause instead of a leak.
Building This Into a Habit
A checklist is only useful if it actually gets used. The simplest way to make that happen is to attach it to an event you already do regularly — right after installing a VPN update, right after switching to a new server, or once a month as a standing reminder. Treating it as a recurring five-minute habit, rather than a one-time setup step, is what actually catches leaks before they become a long-running blind spot.
Want the full explanation of why VPN status icons can be misleading, and how these leaks interact?
Read: Is My VPN Actually Working? →For more background, see the Electronic Frontier Foundation (www.eff.org).
Frequently Asked Questions
How do I check my VPN for leaks?
Check VPN leaks by running a DNS leak test, a WebRTC leak test, and confirming IPv6 is either routed through the VPN or disabled. Do this after connecting, after switching servers, and after any VPN app update.
What's the fastest way to audit VPN privacy?
Work through a fixed checklist rather than checking things ad hoc: connection status, DNS servers shown, WebRTC exposure, IPv6 status, and kill switch behavior, in that order, every time.
Do I need to repeat this checklist every time I use my VPN?
A full check isn't necessary every session, but it's worth repeating after app updates, server switches, protocol changes, or operating system updates, since any of these can silently change leak behavior.