To check for VPN IP and DNS leaks, record what a website sees before you connect. Then run the same tests in the same browser and on the same network after you connect. Compare the public IPv4 address, any IPv6 address, and the DNS resolver results. Treat this as a browser spot check, not certification that every app is protected.
An odd result is worth checking again. One browser test can’t tell you how every app or future connection uses the VPN. These steps give you a fair comparison and useful details to share with your VPN provider.
What Is a VPN leak Check?
A VPN normally sends supported internet traffic through an encrypted connection to a VPN server. Websites then see the VPN server’s public IP address instead of your connection’s ordinary public address. For DNS, use an active browser DNS test rather than a server-side DNS lookup of an arbitrary hostname. BrowserLeaks explains its DNS test: it asks the browser to resolve 50 random domain names, split between IPv4-only and IPv6-only names, and reports the DNS servers observed for those requests. That is evidence about those test lookups, not a trace of every hop or every app’s DNS traffic. Apple explains VPN configurations on its VPNs and privacy page.
A web page reports what happened in that browser, on that network, at that moment. It can’t inspect every app on your device.
Prerequisites
Make sure you have:
- A Mac or iPhone with a working browser and a VPN supported by its provider. These browser comparisons are not tied to one hardware model. The VPN status and Wi-Fi DNS navigation below follows Apple’s current macOS 27 and iOS 27 guides; other settings and provider-app controls may differ by version and configuration.
- An existing VPN connection and access to your provider’s current help pages. If you haven’t set one up, follow your provider’s Mac or iPhone setup instructions first.
- A trusted Wi-Fi network for your first comparison. Avoid a public hotspot that still needs a sign-in page.
- Safari on iPhone or a browser of your choice on Mac. Use that same browser throughout each comparison.
- A private place to record results. Public IP addresses can identify your connection, so obscure them before sharing screenshots publicly.
You don’t need to install a leak-test app. These checks use public websites.
Step-by-Step Guide
Web: Choose Your Test Pages
Step 1: Open an IP test and a DNS test
In your browser, open BrowserLeaks’ IP address test in one tab and DNS Leak Test in another. The first page shows the public address a website sees. Run the DNS site’s test rather than reading only its opening IP display. For a second observation, run BrowserLeaks’ dedicated DNS test, which documents the random-domain method. Keep the results separate and record the test URL. Site layouts can change. Look for the IPv4 address, any IPv6 address, the network owner, and the DNS resolver addresses and organizations.
Keep both tabs open. Refreshing the same pages helps you avoid differences between test services.
Expected result: You can find each site’s results. A blank IPv6 field tells you only that this test showed no IPv6 address. Your connection or the test may have no IPv6 result.
macOS: Test Your Mac
Step 2: Record your Mac’s baseline with the VPN disconnected
On your Mac, disconnect in your VPN app. Then open Apple menu > System Settings > VPN and check its status. Apple’s current VPN settings guide places VPN in the sidebar; you may need to scroll. Available controls depend on the VPN service, and some providers use their own app.
While connected to trusted Wi-Fi, refresh the IP test. Record the public IPv4 address, any IPv6 address, and the network owner. Run the DNS test and record each resolver address and organization. Add the network name, browser, and time. Keep the full baseline addresses out of public posts.
Expected result: You have a record of what the browser showed without the VPN. If iCloud Private Relay is active, Safari may already show a relay address. Record its state and check the Configuration section before you compare results.
Step 3: Connect the Mac VPN
Connect in your VPN provider’s app. Return to Apple menu > System Settings > VPN, or check the provider’s app. Wait for a connected status. Note the VPN server location if the app shows one. Controls vary by provider, so use its current instructions if needed.
Expected result: Your VPN reports that it’s connected before you run the second test.
Step 4: Repeat the Mac IP and DNS tests
Stay on the same Wi-Fi network and use the same browser. Refresh both test pages. Compare the new IPv4 address with your baseline. Compare IPv6 if both tests showed it. Then compare the DNS resolver addresses and organizations.
A typical VPN result shows a different public IPv4 address tied to its exit network. Check an IPv6 address that still matches your baseline, especially if your provider says it protects IPv6. For DNS, read your provider’s current documentation. Some providers use their own resolvers; others name a third party.
Expected result: You have paired results from the same Mac, browser, and network. A different resolver name is a clue, not a pass/fail verdict. Compare the actual resolver addresses with your VPN provider’s documented expected result for that app and configuration. If the provider does not document it, ask support to classify the paired results; leave the outcome unconfirmed until then.
iOS: Test Your iPhone on Wi-Fi
Step 5: Record an iPhone Wi-Fi baseline
On your iPhone, connect to trusted Wi-Fi at Settings > Wi-Fi. Disconnect in your VPN app. Check Settings > General > VPN & Device Management > VPN for its status.
Open the same IP and DNS test pages in Safari. Record IPv4, any IPv6 address, the network owner, DNS resolver addresses and organizations, Wi-Fi network name, and time. Record the iCloud Private Relay state if you use it.
Expected result: You have a Safari baseline for this Wi-Fi connection. You’ll test cellular separately.
Step 6: Connect the iPhone VPN and repeat the Wi-Fi tests
Connect in your VPN provider’s iPhone app. Confirm it reports Connected, then check Settings > General > VPN & Device Management > VPN again. Stay on the same Wi-Fi network. Refresh the IP page and rerun the DNS test in Safari. Compare both results with Step 5.
Expected result: Safari usually sees a public address tied to the VPN exit. If your ordinary IPv4 or IPv6 address remains visible, reconnect and repeat the test. Then check your provider’s guidance.
Step 7: Make a separate cellular comparison
If you use the VPN on cellular, test it separately. First disconnect the VPN. Go to Settings > Wi-Fi and turn Wi-Fi off. Load a normal web page to confirm cellular data works. Run the IP and DNS tests in Safari and record a new cellular baseline.
Connect the VPN again and confirm its status. Repeat both tests with Wi-Fi still off. Restore your preferred Wi-Fi setting when you’re done.
Expected result: You have separate Wi-Fi and cellular comparisons. Different ordinary IP addresses and DNS resolvers are normal across those networks. The Wi-Fi result tells you nothing about the cellular connection.
Configuration: Settings That Change How Results Look
iCloud Private Relay
If you subscribe to iCloud+ and use Safari, check Settings > [your name] > iCloud > Private Relay on iPhone. On Mac, check Apple menu > System Settings > [your name] > iCloud > Private Relay. Record its current state. Apple says Private Relay sends Safari requests through two relays and uses a temporary destination-facing IP address. It is distinct from your VPN; do not assume both services are active on the same traffic path, or attribute every changed address to the VPN. Apple’s Private Relay guidance explains where it applies.
For a clearer comparison, you can temporarily turn Private Relay off. Collect a fresh baseline and repeat the VPN test. Change only that setting, then restore your preferred state.
Custom DNS on iPhone and Mac
On iPhone Wi-Fi, open Settings > Wi-Fi > ⓘ next to the connected network > Configure DNS. Record the displayed DNS configuration and any listed servers. Apple’s iOS 27 Wi-Fi settings guide lists Configure DNS among the settings for the connected network; check cellular on its own.
On Mac, open Apple menu > System Settings > Network > your active network service > Details > DNS. Record any listed servers.
A configured DNS address is not proof that the browser used it. DNS Leak Test’s explanation confirms that browsers can support encrypted DNS (DNS-over-HTTPS), often enabled by default, and that some ISPs run transparent DNS proxies that intercept port-53 lookups regardless of the resolver you configured. Keep the recorded settings separate from the active browser test results; neither is a device-wide routing audit.
Seeing Cloudflare, Google, or another third party doesn’t automatically mean DNS leaked. It may match your own DNS setting or your VPN provider’s setup. Cloudflare documents DNS-only setup on iPhone and Mac separately from its WARP client. Cloudflare DNS alone doesn’t mean you’re using the WARP VPN.
Tips and Troubleshooting
The ordinary public IP still appears after connecting
Check that the VPN app reports Connected. Rerun the test in the same browser and on the same network. Check IPv4 and IPv6 separately. If your ordinary address persists, save both results. Ask the provider whether your server and app settings should route that address type. Pause sensitive browsing if the result conflicts with the protection you need. Check the provider’s documentation for any browser/app exclusions and traffic-blocking option; do not assume those controls exist on every platform or stop all system traffic. Apple explicitly notes that some essential system traffic remains outside a VPN. BrowserLeaks’ IP page also has a separate WebRTC test: record unexpected public-address exposure there separately from the page’s ordinary IP result. A Mac with a USB-C Ethernet adapter or hub may have switched to Ethernet. If it did, record the active network and collect a fresh baseline.
The IP changes, but the DNS test names your ISP or carrier
Check for custom DNS, another filtering or VPN app, and any device management profile. Reconnect the VPN and rerun the DNS test. Compare the resolver with your provider’s documented DNS setup. Send a persistent ISP or carrier result to the provider, especially if its documentation says DNS should use other resolvers. Ask whether each observed resolver is expected for your exact app, network, and DNS settings. Until that is established, report an unexpected observation rather than declaring the connection leak-free or proving a leak from an organization name alone.
Safari and another browser show different results
Record each browser’s name and Private Relay state. Browser privacy features and DNS settings can affect the results. Repeat the comparison within each browser before you compare browsers. Each result describes that browser’s test at that time.
iPhone Wi-Fi and cellular disagree
Treat them as separate tests. Wi-Fi and cellular have different ordinary public addresses. An iPhone’s manual Configure DNS setting belongs to the selected Wi-Fi network. After you switch networks, check that the VPN reconnects before collecting the connected result.
A hotel or café sign-in page will not load
Complete the network’s sign-in before you run a VPN comparison. If you use manual DNS, temporarily set Configure DNS to Automatic or follow your DNS provider’s captive-portal guidance. Sign in, then restore your preferred setting. A travel router also needs its own network setup before you test through it.
What to send your VPN provider
If results still look wrong, send the provider your VPN app version, device model, macOS or iOS version, VPN server location, browser, test URLs, time, and network type. Include paired baseline and connected results for IPv4, IPv6, and DNS. Say whether Private Relay or custom DNS was active. Share full IP addresses privately with support when needed; obscure them in public posts.
Wrapping Up
A before-and-after test can show whether your browser exposes its ordinary public IP or reports an unexpected DNS resolver while the VPN is connected. If a result surprises you, I’d repeat the test on the same network and ask the provider about it. One page load is a spot check.
| Step | Action | Applies To |
|---|---|---|
| Baseline | Record IP and DNS results with VPN disconnected | Mac, iPhone Wi-Fi, iPhone cellular |
| Compare | Connect VPN and repeat in the same browser and network | Mac, iPhone |
| Investigate | Check Private Relay, DNS settings, and provider documentation | Mac, iPhone |