ZoogVPN leak tests: DNS on three servers, plus WebRTC
A VPN that routes your traffic but lets your resolver or your browser announce who you are has failed at the only job it has. There are two common ways that happens — your DNS queries escape the tunnel, or your browser's WebRTC stack discloses your address directly — and neither is visible unless you go looking. We went looking on three servers.
DNS: before and after
The left-hand column is what a DNS leak actually looks like: the real public IP, and three resolvers belonging to a named Ukrainian ISP. Any website you visit sees that. The right-hand column, on a Swiss server, shows six resolvers — all in Switzerland, matching the selected location. Nothing Ukrainian survives into the protected test.
The same test on a German server, recorded as it ran rather than assembled afterwards: unprotected resolvers first, then the connection, then a re-run that greets the Frankfurt exit.
And the completed German test as a still. Three servers, two countries, no leak in any of them.
WebRTC
WebRTC is the leak most VPNs lose on, because the browser makes the disclosure itself and the tunnel never sees it happen. BrowserLeaks reports No Leak, with both the local-address and public-address rows empty and the session description carrying only 127.0.0.1 — no candidate exposing the real LAN or WAN address.
The cross-check is what makes this worth showing: the remote IP the test detected, 216.106.187.78, is the same exit IP displayed in the ZoogVPN window in the same screenshot. A "no leak" result means nothing if the test simply failed to run; here it clearly ran, and saw only the VPN.
One thing we will not dress up
The resolvers on both the German and Swiss exits are Google's. They are in the right country, which is exactly what defeats a geographic DNS leak, and that is the result we measured. But they are not private ZoogVPN resolvers, and we are not going to describe them as such. If your threat model includes Google specifically, this is a detail you should weigh rather than a box you should tick.
What we did not test
- IPv6 leaks. One frame shows "IPv6: Not detected" and the WebRTC test shows no IPv6 remote address, but neither of those is an IPv6 leak test. We are not claiming IPv6 protection.
- Kill-switch behaviour. These tests ran on a stable connection. What leaks during a drop — the realistic leak window — is a separate test we have not run.
- One browser family, one OS per test.