Guides

DNS leaks and WebRTC leaks: how they work, how to check, and how to fix them

cdnping · 2026-10-17

A proxy takes over your "connections," but before and outside of those connections the browser does two easily overlooked things: it looks up domain names, and it discovers its own public address for real-time communication. Leaks happen in these two places.

DNS leak

Visit example.com , the system first has to ask a DNS server for its IP. If that query goes to your local ISP's DNS, then:

How to check yourself:cdnping IP checkhas the browser resolve several random subdomains, then checks which DNS servers performed the lookups. If the resolver's country differs from the exit IP's country, there is a leak.

How to fix: Enable "remote DNS" or fake-ip mode in your proxy client so domain names are resolved by the proxy server; or enable DNS over HTTPS in your browser and make sure DoH traffic also goes through the proxy.

WebRTC leak

WebRTC is the browser technology behind video calls and screen sharing. To get through the network, it sends a UDP request to a STUN server asking, "What address do you see for me?" Many proxies only handle TCP, so this UDP request goes straight out from your local network, and STUN returns your real public IP, which page scripts can read directly.

How to check yourself: Compare the public address obtained via WebRTC with the exit IP of web requests. The cdnping check shows both.

How to fix: Use TUN / virtual network adapter mode, which takes over all traffic; or restrict WebRTC's network interfaces in your browser (Chromium-based browsers can use the official WebRTC Network Limiter extension; in Firefox, go to about:config media.peerconnection.ice.default_address_only).

LAN addresses and mDNS

By default, modern browsers replace local network addresses with random xxxx.local Hostname (mDNS), not visible to web pages 192.168.x.x style local addresses. If the result shows your local IP directly, your browser has this protection turned off.

Try it yourself

Reading is good; testing it yourself is better.

Check for DNS & WebRTC leaks →

Keep reading