MaskNet Tools
Leak test: DNS and WebRTC
Two checks on one page. The first shows which DNS servers your lookups travel through and whether they expose your provider. The second looks at whether your browser reveals your real IP address through WebRTC.
DNS leak check
Even with a VPN on, DNS lookups sometimes go straight to your provider. That means the list of sites you open is visible, even though the traffic itself is encrypted. The check takes a few seconds.
WebRTC check
WebRTC powers calls and video chat in the browser, but it can also reveal your real IP address even while a VPN is on. Check whether that happens for you.
Checking WebRTC…
How it works
When you open a site, your device first asks a DNS server which IP address the name belongs to. That server usually belongs to your internet provider. Even when all traffic goes through a VPN, the DNS request can slip past it — and your provider still sees the names of the sites you open, even though the page contents are encrypted.
The check works like this: your browser looks up a random one-time subdomain in our zone. On our side we see which DNS server came to resolve it and identify its network by autonomous system number. If it is the network of a public resolver that a protected MaskNet connection is set to use, the lookups are protected. If it is your internet provider's network, it can see the names of the sites you open.
WebRTC is a separate mechanism. It powers in-browser calls and, to do that, discovers your network addresses, including your external IP. Sometimes it hands that address to a site directly, bypassing the VPN. The check compares the WebRTC address with the one sites see normally: if they differ, WebRTC is giving away more than it should.
FAQ
Common questions
What is a DNS leak?+
It's when DNS lookups go straight to your internet provider instead of through your protected connection. The traffic itself stays encrypted, but the provider still sees the names of the sites you open.
Does a VPN stop DNS leaks?+
Not always. Some VPN apps leave the system DNS untouched, so lookups travel outside the tunnel. MaskNet routes DNS lookups through its own servers.
What does the WebRTC check show?+
Whether your browser reveals your real IP address through WebRTC. If it does, a site can learn the address you keep behind MaskNet.
The check found a leak — what now?+
Connect MaskNet: DNS lookups go through its servers and traffic to your device is encrypted. For WebRTC, the knowledge base walks through the browser settings.