A DNS leak means your traffic is encrypted but your lookups are not. The tunnel carries the data while your device quietly asks your ISP's resolver which address to connect to — handing over a list of every site you visit.
DNS leak protection: what changes
The page request may be encrypted while the DNS lookup still reveals the destination domain.
Without DNS leak protection
DEVICEDNS query outside tunnelISP DNSsees domain
Exposure
The resolver can associate queried domains with the user's network connection.
The ISP resolver is not used for the lookup, subject to correct app and OS configuration.
Verify with repeatable IPv4, IPv6 and WebRTC tests.
ZoogVPN documents DNS leak protection in its apps; VPN Sherlock should publish observed test conditions before claiming test results.
Left: the query escapes to the ISP resolver. Right: the query travels inside the tunnel.
Three leaks with different causes
These are separate problems. Passing a DNS test says nothing about the other two.
Swipe or use arrow keys to see the full table
Leak
Cause
Fix
DNS leak
The OS sends lookups to a resolver outside the tunnel. Windows is prone to this because it may query every interface at once and use whichever answers first.
The client must set the tunnel's resolver and block queries to any other.
IPv6 leak
The tunnel carries IPv4 only, but the OS prefers IPv6 and sends that traffic over the normal connection.
The client must either carry IPv6 through the tunnel or disable it while connected.
WebRTC leak
A browser API discovers local and public addresses for peer-to-peer connections and exposes them to a page through ICE candidates.
Browser-level: disable or restrict WebRTC, or use an extension. A VPN alone does not fix this.
WebRTC is a browser problem
No VPN can fully close a WebRTC leak on its own, because the leak happens inside the browser before traffic reaches the network stack. Any provider claiming otherwise is overstating what is technically possible. Check it in the browser you actually use.
How to check
Note your real IP address and ISP before connecting.
Connect to a VPN server in a different country.
Run a DNS leak test and confirm every resolver shown belongs to the VPN, not your ISP.
Run an IPv6 check and confirm either no IPv6 address is shown or it belongs to the VPN.
Run a WebRTC check in each browser separately — results differ between them.
Repeat after forcing a reconnect, which is when leaks most often appear.
What ZoogVPN states
According to ZoogVPN
ZoogVPN says: "When you are using ZoogVPN apps, we protect you from DNS leaks. Our applications are configured in a way that makes it impossible for ISP to send DNS queries," and that it resolves domains using other DNS servers. Its leak-protection page does not specifically address IPv6 or WebRTC leaks, and we have not independently tested any of these behaviours.
Because IPv6 and WebRTC are not covered by that statement, verify them yourself using the steps in how to test a VPN.
Frequently asked questions
What is a DNS leak?
Your traffic goes through the tunnel but your domain lookups go to a resolver outside it, usually your ISP's. The effect is that the contents of your browsing are protected while the list of sites you visited is not, which defeats much of the point. It is common because the operating system decides where lookups go, and the VPN client has to override that decision rather than simply existing.
Can a VPN stop WebRTC leaks?
Not completely. WebRTC asks the browser for candidate addresses, so the exposure happens inside the browser rather than in the network path the VPN controls. A VPN can prevent the public address from being the real one, but the reliable fix is a browser setting or extension. Test each browser you use separately, because the behaviour differs between them.
Why do leaks appear after reconnecting?
During a reconnect the virtual interface disappears briefly and the operating system falls back to its default resolver. This is the window that matters, and it is why testing a VPN while it sits idle tells you little. A firewall-level kill switch is what prevents it, because it blocks traffic outside the tunnel rather than waiting for the client to re-establish one.
Can I just set my own DNS instead?
You can, and it helps against an ISP resolver, but it does not solve the same problem. A manually set public resolver still sees your lookups and still sits outside the tunnel unless the client routes it inside. The goal is for lookups to travel through the tunnel, not merely to go somewhere else.
Does IPv6 cause leaks even when DNS is fine?
Yes, and it is the one people miss. If the tunnel carries only IPv4 while your connection also has IPv6, the operating system may prefer IPv6 and route that traffic outside the tunnel entirely. Check for an IPv6 address separately; either none should appear or the one that does should belong to the VPN.