MaskNet Tools

Leak test: DNS and WebRTC

Two checks on one page. The first shows which DNS servers your lookups travel through and whether they expose your provider. The second looks at whether your browser reveals your real IP address through WebRTC.

DNS leak check

Even with a VPN on, DNS lookups sometimes go straight to your provider. That means the list of sites you open is visible, even though the traffic itself is encrypted. The check takes a few seconds.

WebRTC check

WebRTC powers calls and video chat in the browser, but it can also reveal your real IP address even while a VPN is on. Check whether that happens for you.

Checking WebRTC…

How it works

When you open a site, your device first asks a DNS server which IP address the name belongs to. That server usually belongs to your internet provider. Even when all traffic goes through a VPN, the DNS request can slip past it — and your provider still sees the names of the sites you open, even though the page contents are encrypted.

The check works like this: your browser looks up a random one-time subdomain in our zone. On our side we see which DNS server came to resolve it and identify its network and country. A resolver in Russia — your provider's, Yandex's or the national NSDI system — is a leak: your provider sees the names of sites, and Russian resolvers increasingly substitute answers. With MaskNet connected and every resolver outside Russia, MaskNet resolvers handle the lookups and there is no leak. More in DNS substitution.

WebRTC is a separate mechanism. It powers in-browser calls and, to do that, discovers your network addresses, including your external IP. Sometimes it hands that address to a site directly, bypassing the VPN. The check compares the WebRTC address with the one sites see normally: if they differ, WebRTC is giving away more than it should.

FAQ

Common questions

What is a DNS leak?+

It's when DNS lookups go straight to your internet provider instead of through your protected connection. The traffic itself stays encrypted, but the provider still sees the names of the sites you open.

Does a VPN stop DNS leaks?+

Not always. Some VPN apps leave the system DNS untouched, so lookups travel outside the tunnel. MaskNet routes DNS lookups through its own servers.

Why is Yandex DNS a leak?+

It is a resolver in Russia, like your provider's resolver or the national NSDI system. Russian resolvers see which sites you open and substitute answers. The check treats any resolver in Russia as a leak.

What does the WebRTC check show?+

Whether your browser reveals your real IP address through WebRTC. If it does, a site can learn the address you keep behind MaskNet.

The check found a leak — what now?+

Connect MaskNet: DNS lookups go through its servers and traffic to the MaskNet network will be encrypted. For WebRTC, the knowledge base walks through the browser settings.