How DNS exposure works
DNS converts domain names into network addresses. A resolver can observe requests it handles, subject to its logging and privacy practices.
A DNS leak concern arises when requests go to an unexpected resolver instead of the one your network or VPN should use.
Reliable testing needs controlled DNS queries and authoritative logs; a browser page cannot infer every resolver path.
How WebRTC exposure works
WebRTC supports real-time browser communication. During connection setup, candidate information can expose public or local network details to a site.
Modern browsers often protect local addresses with mDNS names, so a masked local result can be normal.
WebRTC behavior depends on browser settings, extensions, permissions, and the network path.
Why the signals are different
DNS testing focuses on which resolver receives a name lookup. WebRTC testing focuses on connection candidates exposed by the browser.
One result does not prove the other. A clean-looking WebRTC result does not confirm DNS routing, and vice versa.
Both tests provide limited observations rather than a complete privacy audit.
How to respond to a result
First compare observed providers and addresses with your expected network or VPN. Unexpected results may have benign routing explanations.
Update browser and VPN software, review DNS and IPv6 settings, and retest after a configuration change. Avoid treating a single result as a guarantee.
- Compare the observed resolver or candidate with the network you expected.
- Make one configuration change at a time, then retest.
Expected DNS resolver: VPN provider
Observed resolver: different network provider