> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/diagnose/am-i-leaking-my-real-ip.md).

# Am I Leaking My Real IP?

A VPN hides the address a website sees on your normal page requests. It does not automatically cover everything else your device sends. Three side channels are responsible for almost every real-world leak.

{% hint style="success" %}
**Quick answer.** Run the three tests on [ipcheck.ing](https://ipcheck.ing) with your VPN on: the **IPv6 card** in IP Infos, the **WebRTC Leak Test**, and the **DNS Leak Test**. If none of them shows your home ISP or your home country, you are not leaking through the common paths.
{% endhint %}

## First, know your real address

Turn the VPN off, load ipcheck.ing, and note the IP, the ISP, and the country on the first card. Then turn the VPN back on. "Leak" simply means one of the tests below shows that old value again.

## Leak 1 — WebRTC

**What it is.** WebRTC lets browsers make direct audio, video, and data connections. To do that it has to discover what address the outside world sees for you, and it asks a STUN server directly — over UDP, often ignoring the browser's normal proxy settings. Any web page can trigger this silently. Background: [What Is WebRTC?](/knowledge-base/concepts/what-is-webrtc.md)

**How to test.** Open the [WebRTC Leak Test](/knowledge-base/connection-tools/webrtc-test.md) section. MyIP queries four independent STUN servers and shows the address each one reports, along with a guessed NAT type, the ISP, and the region.

| What you see on the cards     | Verdict                                                                 |
| ----------------------------- | ----------------------------------------------------------------------- |
| The VPN's exit IP on all four | No leak                                                                 |
| Your real IP on any card      | **Leaking**                                                             |
| "WebRTC Unavailable"          | No leak — WebRTC is switched off in this browser                        |
| "Connection Error" everywhere | Inconclusive; something blocked STUN. Retry before drawing conclusions. |

**How to fix it.**

* Use your VPN provider's desktop or mobile app rather than a browser extension. Extensions usually proxy HTTP requests only; a system-level tunnel covers UDP too.
* Turn WebRTC off if you do not use browser video calls. In Firefox, set `media.peerconnection.enabled` to `false` in `about:config`. Chrome has no built-in switch — you need an extension, or a browser profile without it.
* If you need WebRTC and a VPN, check after every VPN update. This behaviour changes with client versions.

## Leak 2 — DNS

**What it is.** Before your browser can load a site, something has to translate the name into an address. If that lookup goes to your ISP's resolver while your traffic goes through the VPN, your ISP still gets a list of every domain you visit. Your IP is hidden; your browsing history is not. Background: [How DNS Works](/knowledge-base/concepts/how-dns-works.md)

**How to test.** Open the [DNS Leak Test](/knowledge-base/connection-tools/dns-leak-test.md). MyIP looks up freshly generated one-off domain names, then reports the resolvers that actually reached its name servers — their exit IP, operator, and region.

| What you see                                                      | Verdict                             |
| ----------------------------------------------------------------- | ----------------------------------- |
| Resolvers belonging to your VPN provider                          | No leak                             |
| A public resolver you chose yourself (Cloudflare, Google, Quad9…) | No leak, as long as you intended it |
| **Your home ISP's name, or your home country**                    | **Leaking**                         |

{% hint style="info" %}
Several resolvers in several countries is normal, not a symptom. Large operators run servers worldwide and forward queries internally. Judge by the operator name, not the count.
{% endhint %}

**How to fix it.**

* Enable the VPN's own DNS setting, sometimes called "use VPN DNS" or "DNS leak protection".
* Or set a resolver manually on your device or router — any public resolver you trust.
* Or turn on encrypted DNS in your browser (DNS over HTTPS). This stops your ISP reading the queries even when they still travel over its network.

On the official site, **Advanced Tools → In-depth DNS Leak Test** captures far more resolvers per run and also shows whether any of them forwards part of your real IP upstream (EDNS Client Subnet) and whether DNSSEC is in play. This tool is only available on ipcheck.ing, not on self-hosted copies.

## Leak 3 — IPv6

**What it is.** The quietest of the three. Many VPNs only carry IPv4. Meanwhile your ISP has given you a working IPv6 address. Your VPN happily tunnels the IPv4 half of your traffic — and any site reachable over IPv6 gets your real, ISP-assigned IPv6 address instead, because modern devices prefer IPv6 when it is available. Background: [IPv4 vs IPv6](/knowledge-base/concepts/ipv4-vs-ipv6.md)

**How to test.** With the VPN on, look at the **IPCheck.ing IPv6** card in [IP Infos](/knowledge-base/connection-tools/ip-information.md).

| IPv6 card shows                                | Verdict                                      |
| ---------------------------------------------- | -------------------------------------------- |
| Empty, or "Fetch Failed or No IPv6 Address"    | Safe. The VPN blocks IPv6, or you have none. |
| An address whose ISP matches your VPN          | Safe. The VPN carries IPv6 too.              |
| **An address whose ISP is your home provider** | **Leaking**                                  |

From a terminal you can check the same thing in one line:

```bash
curl 6.ipcheck.ing
```

No answer, or an error, means no IPv6 path — which is what you want if your VPN is IPv4-only. An answer that matches your home ISP is the leak.

**How to fix it.**

* Turn on IPv6 support in the VPN client if it has one.
* Otherwise disable IPv6 for the duration — on the device's network adapter, or on your router. Blunt, but effective.
* Prefer VPN clients with a kill switch that blocks all non-tunnel traffic, IPv6 included.

## Putting it together

| Test   | Where in MyIP        | Leaking looks like                |
| ------ | -------------------- | --------------------------------- |
| IPv6   | IP Infos → IPv6 card | Your home ISP on the IPv6 card    |
| WebRTC | WebRTC Leak Test     | Your real IP on any STUN card     |
| DNS    | DNS Leak Test        | Your ISP as the resolver operator |

Run all three. Passing one proves nothing about the other two.

<details>

<summary>What about other leaks people mention?</summary>

Two more are worth knowing about, though neither exposes your IP directly.

**Timezone and language.** If your browser reports a timezone that does not match your exit country, a site can infer that you are using a proxy. The [Invisibility Test](/knowledge-base/connection-tools/invisibility-test.md) checks exactly this, among other signals.

**Browser fingerprinting.** Your fonts, screen size, and graphics stack combine into a value that can follow you across sessions regardless of your IP. See [Browser Fingerprinting Explained](/knowledge-base/concepts/browser-fingerprinting.md).

</details>

<details>

<summary>Everything passes but a site still blocks me</summary>

That is not a leak. Many VPN exit addresses appear on published lists of datacenter and VPN ranges, and sites block on that basis alone. The [Invisibility Test](/knowledge-base/connection-tools/invisibility-test.md) (official site only) checks your address against several such lists and shows the other signals that give a proxy away.

</details>

## Still stuck?

* [Is My VPN or Proxy Working?](/knowledge-base/diagnose/is-my-vpn-working.md) — the full connection check
* [Security Checklist](/knowledge-base/lookup-privacy/security-checklist.md) — a broader look at your digital footprint
* [Why Do Sites See a Different IP?](/knowledge-base/diagnose/why-do-sites-see-a-different-ip.md) — when several different addresses are all legitimate


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ipcheck.ing/knowledge-base/diagnose/am-i-leaking-my-real-ip.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.