DNS, IPv6 and WebRTC leaks: what they are and how to check yours

A VPN can be up while your DNS, your IPv6 address or your browser quietly walk out the front door. Here is what each leak is — and the guard for each one.

4 August 2026 · 6 min read · Updated 7 September 2026

The short version. Three classic ways a “connected” VPN still exposes you: DNS queries escaping the tunnel, IPv6 traffic bypassing an IPv4-only tunnel, and the browser itself revealing addresses through WebRTC. PryVPN forces DNS inside the tunnel on every plan, routes so drops fail silent, and the apps verify the device instead of assuming — then tell you the result in plain words.

1. DNS leaks: asking directions in the clear

Before your device opens any connection it resolves the name — and that question traditionally goes to whoever runs the local network. A tunnel that carries your traffic but leaves DNS at the hotel router tells the hotel every domain you visit. The padlock on the site does not help: the lookup happened before the padlock existed.

The fix has two halves. First, the tunnel must impose its own resolvers, so queries travel the same encrypted path as everything else. PryVPN does this on all plans, without exception: DNS inside the tunnel is not a premium setting, it is the baseline. Second, someone has to check the device is actually using them — a system-wide “Private DNS” override or a second network interface can silently win. That is why the PryVPN app verifies both the system Private DNS setting and the DNS of the VPN interface itself, and warns you when either points elsewhere.

2. IPv6 leaks: the second internet you forgot

Most networks today speak two protocols. Many VPN profiles only route one of them. If your tunnel claims IPv4 while the device happily sends IPv6 straight out, half your traffic never met the VPN at all — and IPv6 addresses tend to be stable enough to identify a household.

The robust answer is unglamorous: the client must account for both families, and the anti-leak story has to cover v6 explicitly rather than hoping the network is v4-only. PryVPN treats IPv6 leak protection as its own checklist item, verified on the device next to the DNS checks — pass, fail or unknown, never a silent assumption.

3. WebRTC leaks: the browser telling on you

WebRTC — the technology behind browser calls and screen sharing — discovers your network paths to establish direct connections, including via STUN servers outside the page you are visiting. In a misconfigured setup, a single website can learn addresses the tunnel was supposed to hide, with no download and no permission prompt involved.

Browser-level protection belongs in the browser layer: the PryVPN extensions for Chrome and Firefox route through the session proxy and include a WebRTC seal, so discovery traffic has no cleartext path to take. If you work from a browser all day, that seal matters as much as the tunnel underneath it.

How to check all three in one minute

Connect PryVPN on the network you distrust most — that borrowed Wi-Fi is the honest test.
Open the Speed section of the app and run the leak check: it reports DNS and interface state as pass, fail or unknown.
If anything reports fail, read what it names — usually a Private DNS override or a second active interface — fix that one setting, and re-run.

Unknown is an honest answer, not a shrug: some networks and some Android skins hide the state the check needs. In that case the safe assumption is the tool's own — treat the network as hostile until a check passes.

Why two leak tests can disagree

Run three different “is my VPN working” pages and you may get three different verdicts. That is usually not a contradiction — they measure different things. One page checks which organization owns your visible address (a database guess, not a measurement of your tunnel). Another runs JavaScript in your browser and watches what the browser volunteers. A third resolves a unique hostname and watches which resolver asks for it.

Each method has blind spots: geolocation databases are fuzzy at city level, residential-looking exit addresses defeat datacenter heuristics, and a page can only see the browser it runs in — not your other apps. The correct way to read them is as a panel, not a referee: if the visible address matches your exit node, DNS resolves inside the tunnel, and WebRTC shows nothing public, the setup holds. Any single red flag deserves the one-minute check above, not an argument about which tester to believe.

Questions we hear

How do I know my VPN is working?

Check the visible address with the tunnel off and on — it should change to your exit node's city. Then verify the side channels: DNS resolving inside the tunnel, no public WebRTC candidates, no IPv6 bypass. The PryVPN app's leak check covers the device side in one tap; an independent leak-test page covers the browser side.

Should I just disable IPv6 entirely?

It stops v6 leaks the way demolishing a bridge stops traffic on it — effective, crude, and increasingly inconvenient as more of the internet goes v6-first. Better to use a client that accounts for both families and verifies it. Disabling v6 is a fine temporary diagnostic, not a strategy.

Do free VPNs leak more often?

Leaks correlate with client quality, not price tags: outdated apps, missing kill-switch routing, and DNS left at defaults. That said, free tiers are where providers cut client investment first, so in practice the worst leak stories cluster there. Whatever you use, run the one-minute check — trust the measurement, not the price.

Is WebRTC dangerous even without a VPN?

Without a VPN there is less to leak — your address is already visible to every site you visit. WebRTC matters precisely when you have something to protect: it can hand out addresses around the tunnel. With PryVPN's browser extensions, the WebRTC seal closes that path.

Jonas KellerSecurity Researcher

Jonas tests what the apps promise: leak checks, kill-switch behavior, and everything on the never-logged list.

Reviewed by Mara Vidal · Updated 7 September 2026