How to Test If Your VPN Is Actually Working (DNS, IP and WebRTC Leak Checks)

You paid for a VPN, you clicked Connect, and the app says you’re protected. But is your traffic actually going through the tunnel — or is your real IP address quietly visible to every website you visit? A VPN that “looks connected” can still leak your identity in three different ways: through your IP address, through your DNS queries, and through your browser’s WebRTC feature.

This guide is for anyone who just bought a VPN and wants proof it works, and for anyone whose VPN has started behaving strangely (wrong region content, ISP-branded pages appearing, or warnings from leak-test sites). You don’t need any technical background — every test here takes under two minutes and uses free browser-based tools.

By the end, you’ll have run a complete four-part verification: an IP check, a DNS leak test, a WebRTC leak test, and a kill switch test. You’ll also know how to fix the most common failures — and when the honest answer is that your current VPN isn’t doing its job and should be replaced.

Table of Contents

• What “working” actually means for a VPN
• Test 1: The basic IP address check
• Test 2: DNS leak test
• Test 3: WebRTC leak test
• Test 4: Kill switch test
• Common problems and fixes (user-reported)
• FAQ
• Conclusion: what to do if your VPN keeps failing

What “working” actually means for a VPN

A VPN is only doing its job when all three of these are true at the same time:

Check	What it verifies	What a failure exposes
IP address	Your traffic exits from the VPN server, not your home connection	Your approximate location and ISP identity
DNS queries	Website lookups go to the VPN’s DNS servers, not your ISP’s	Every domain you visit, readable by your ISP
WebRTC	Your browser isn’t revealing your IP directly to websites	Your real IP, even with the tunnel fully active

The reason you need separate tests: these are three separate pathways. ExpressVPN’s own documentation puts it plainly — a VPN “can fail to protect your device’s DNS queries even when the rest of your traffic is concealed by the VPN tunnel.” In other words, a green “Connected” status in the app guarantees none of the three on its own. [1]

Run the tests in the order below. Each one builds on the previous.

Test 1: The basic IP address check

This is the before-and-after comparison NordVPN recommends as the first sanity check: if your public IP changes when you connect, the tunnel is active. [2]

1. Disconnect your VPN completely. Quit the app or toggle it off — don’t just switch servers.
2. Look up your current public IP. Search “what is my IP” in your browser, or use the IP readout at the top of browserleaks.com. Write the address down along with the city and ISP shown.
3. Connect your VPN to any server — ideally one in a different country so the change is unmistakable.
4. Refresh the same IP lookup page. Do a hard refresh (Ctrl+Shift+R / Cmd+Shift+R) so you’re not reading a cached result.
5. Compare. You pass if the IP address is different, the location matches the VPN server you picked, and the ISP field now shows a hosting or VPN-related company instead of your home ISP.

If the IP didn’t change, the tunnel is not routing your traffic at all. Reconnect, try a different server, and re-test before moving on — the remaining tests assume the tunnel is up.

Test 2: DNS leak test

Every time you visit a website, your device first asks a DNS server to translate the domain name into an IP address. If those lookups escape the tunnel, your ISP still sees every domain you visit — even though the page content itself is encrypted. That’s a DNS leak. [1]

Independent leak-testing tools work by making DNS requests for a unique hostname with the VPN off, then repeating the process with the VPN on; if the same organization resolves your queries both times, you have a leak. [4]

1. Connect your VPN.
2. Open a DNS leak test. ExpressVPN hosts an official one at expressvpn.com/dns-leak-test [1]; independent options include top10vpn.com/tools/do-i-leak [4]. Running two different tools is a reasonable double-check.
3. Run the extended/standard test if offered, not just the quick one — it sends multiple queries and catches intermittent leaks.
4. Read the results. You pass if every DNS server listed belongs to your VPN provider or a third-party resolver the VPN routes through. You fail if you see your own ISP’s name, or servers located in your real home region while you’re connected elsewhere.

Reputable VPNs prevent DNS leaks by operating their own DNS servers and pushing every query through the encrypted tunnel — ExpressVPN, for example, runs dedicated DNS infrastructure with end-to-end encrypted traffic between your device and its resolvers, so your ISP never handles the lookup. [1] If your provider doesn’t do this, no amount of client-side tweaking fully closes the gap.

If you fail: reconnect first (a fresh connection re-applies DNS settings), then check your VPN app’s settings for an option like “use VPN DNS servers only” or built-in leak protection and make sure it’s enabled. Manual OS-level VPN configurations are the most common source of persistent DNS leaks — the native apps handle DNS overrides for you.

Test 3: WebRTC leak test

WebRTC is a real-time communication feature built into Chrome, Firefox, Edge, and most modern browsers (it powers browser-based video calls). The problem: it can disclose your IP address directly to websites through your browser, bypassing the VPN tunnel entirely. This is the leak that surprises people most, because it happens while the VPN is connected and passing every other test.

1. Connect your VPN.
2. Visit browserleaks.com/webrtc. [3]
3. Compare the “WebRTC IP” readout to your real IP from Test 1. Local network addresses (starting with 192.168.x.x or 10.x.x.x) are not a concern — they only identify your device inside your home network.
4. You pass if the WebRTC section shows no public IP, or only the VPN server’s IP. You fail if your real public IP from Test 1 appears anywhere on the page.

If you fail, fix it in the browser — this is a browser behavior, not a tunnel failure:

• Firefox: type about:config in the address bar, search for media.peerconnection.enabled, and set it to false. [3]
• Chrome: Chrome doesn’t expose an equivalent switch, so BrowserLeaks recommends Google’s official WebRTC Network Limiter extension, which restricts which network routes WebRTC may reveal. [3]
• Any browser: many VPN providers also ship browser extensions that block WebRTC leaks alongside the main app — check whether yours offers one before installing third-party tools.

Note that fully disabling WebRTC will break browser-based video calling until you re-enable it. The Network Limiter approach keeps calls working while limiting exposure.

Test 4: Kill switch test

A kill switch cuts your internet the moment the VPN connection drops, so traffic never silently falls back to your bare connection. If your app has one (both NordVPN and ExpressVPN do — check the app’s settings for “Kill Switch” or “Network Lock”), verify it’s actually armed:

1. Enable the kill switch in your VPN app’s settings.
2. Connect to a VPN server and start loading any website.
3. Force-drop the connection — the crude but effective way is to briefly toggle your Wi-Fi off and back on, or switch Wi-Fi networks mid-session.
4. Watch what happens. You pass if the internet stays blocked until the VPN reconnects. You fail if pages keep loading normally during the gap — that gap is exactly when your real IP would have been exposed.

Common problems and fixes (user-reported)

These are recurring failure patterns that users report in VPN communities and support forums — labeled as user reports, not lab results:

• “My VPN passes every test but streaming sites still detect it.” Users report this is usually IP-reputation blocking by the streaming service, not a leak — the site recognizes the VPN server’s IP range. Switching servers, or using a provider that rotates IPs frequently, is the standard workaround.
• “DNS leak only on my phone / only on one device.” Users frequently trace this to a manually configured VPN profile or a “private DNS” OS setting overriding the app. The fix reported most often: remove manual profiles and use the provider’s official app, which manages DNS itself.
• “WebRTC leak came back after a browser update.” Users report browser updates occasionally resetting about:config flags or disabling extensions. Re-run Test 3 after major browser updates.
• “IPv6 address still visible.” Some users report leaks specifically over IPv6 when their VPN only tunnels IPv4. Reported fixes: enable the app’s IPv6 leak protection if present, or disable IPv6 in the OS network adapter settings while using the VPN.
• “Kill switch didn’t trigger.” Users report kill switches shipped disabled by default in some apps — it’s a setting you must turn on, not assume.

If a leak survives reconnecting, enabling the app’s leak-protection settings, and the browser fixes above, the problem is the provider — not your setup.

FAQ

How do I check if my VPN is working without installing anything? Run the three browser tests in this guide: an IP lookup before/after connecting, a DNS leak test (expressvpn.com/dns-leak-test or top10vpn.com/tools/do-i-leak), and browserleaks.com/webrtc. All are free, browser-based, and take about five minutes total.

My IP changed but the DNS test shows my ISP. Is my VPN working? Partially — and that’s not good enough. The tunnel is active, but your ISP can still log every domain you visit through the leaked DNS queries. [1] Enable the VPN’s DNS/leak-protection setting or switch to a provider that runs its own DNS servers.

How often should I re-test my VPN? Re-run all the tests after installing the VPN, after major OS or browser updates, after changing VPN protocols or settings, and any time you’ll rely on it for something sensitive (public Wi-Fi, travel).

Does a WebRTC leak mean my VPN is bad? Not necessarily — WebRTC leaks originate in the browser, which can hand out your IP independently of the tunnel. Fix it with the Firefox media.peerconnection.enabled flag or Chrome’s WebRTC Network Limiter extension. [3] That said, better VPN suites ship browser extensions that block this for you.

Is a “Connected” status in the VPN app enough proof? No. The app status confirms a tunnel was established — it does not verify where your DNS queries go or what your browser reveals via WebRTC. Only the leak tests confirm those. [1]

Conclusion: what to do if your VPN keeps failing

Run all four tests whenever you set up a VPN or change anything about your network. Most failures are fixable in minutes: reconnect, enable the app’s DNS and kill switch protections, and patch the WebRTC hole in your browser.

But if your VPN repeatedly leaks DNS queries, has no kill switch, or fails tests after every update, the tool itself is the weak link. The providers that consistently pass these checks are the ones that run their own DNS infrastructure and build leak protection into the apps by default — that’s exactly what NordVPN and ExpressVPN are known for, and both publish their own public leak-testing tools so you can verify before and after buying. [1][2]

Try a VPN that passes every leak test — and verify it yourself in five minutes