Sign inMonitor a domain
VPN check · neutral

Is my VPN actually working?

Four checks in about five seconds. Nothing is stored unless you choose to share the result.

–/4

Running the checks…

Each light fills in as its result arrives.

  • IPv4 exitChecking…
  • IPv6 exitChecking…
  • WebRTCChecking…
  • DNS resolverChecking…

VPN exit vs DNS resolver

VPN exit……
DNS resolverNot testedNeeds our DNS responder

When our DNS responder is running, this compares where your lookups are answered with where your traffic leaves.

If a check failed: fix it on your device

  1. In your VPN app, turn on its kill switch and any “DNS leak protection” or “block IPv6” option, then reconnect.
  2. If the IPv6 check showed a different network than IPv4, and your VPN has no IPv6 setting: Control Panel › Network and Sharing Center › Change adapter settings › right-click your Wi-Fi or Ethernet adapter › Properties › untick “Internet Protocol Version 6 (TCP/IPv6)”.
  3. Windows can send DNS queries out of every adapter at once (“smart multi-homed name resolution”). On Pro editions you can switch that off: run gpedit.msc › Computer Configuration › Administrative Templates › Network › DNS Client › “Turn off smart multi-homed name resolution” › Enabled.
  4. Check that no browser below is using its own secure DNS provider, then run this check again.
Microsoft: DNS Client policy settings
We don’t sell VPNs.

No affiliate links, no rankings, no “best VPN” lists. This check reports what your connection does; it never recommends a brand. See our policy.

How each check works

  • IPv4 and IPv6 exit: your browser asks our IPv4-only and IPv6-only hostnames for the address they see. If the two leave through different networks, your IPv6 is skipping the VPN.
  • WebRTC: your browser asks public STUN servers (Google and Cloudflare) for its public address, as a video-call page would. We only show whether an address other than your exit appeared; the candidates never leave your browser.
  • DNS resolver: your browser looks up a one-time name under our own DNS zone, and our DNS server records which resolver asked. If that resolver is on a different network or country than your exit, your lookups leak.

Network names and countries come from DB-IP Lite (IP Geolocation by DB-IP) and the cloud ranges providers publish. More on our data sources, or check what sites see about your connection.