IP Addresses and DNS: What a VPN Changes

A VPN changes two things that normally reveal a lot about you: it replaces your public IP address with the VPN server's, and it can route your DNS lookups through the encrypted tunnel so your ISP can't see them. Your IP address is roughly your device's return address on the internet, and DNS is the system that turns names like example.com into the numbers computers actually use — together they expose who and where you are, and which sites you're asking for.

Your IP address says roughly who and where you are; your DNS lookups say what you're trying to reach. A VPN can mask both — but only if DNS actually goes through the tunnel.

What your IP address reveals

Your public IP address is assigned by your internet provider and travels with every request you make, so websites use it to see roughly where you are (city or region level) and to recognise return visits. A VPN replaces it with the address of the VPN server, so sites see the server's location instead of yours, and your real IP stays with the VPN provider rather than being shown to every site you visit. It's not pinpoint tracking — an IP doesn't give your street address — but it's enough for region blocks and coarse location.

What DNS reveals — and how a VPN hides it

Every time you visit a site, your device first asks a DNS resolver to look up its address. By default that resolver is your ISP's, which means your ISP sees a running list of every domain you request — even when the page itself is encrypted with HTTPS. A VPN sends those DNS requests through the tunnel to the VPN's own resolver, so your ISP no longer sees them. The diagram shows both paths:

DNS leaks: when it doesn't work

A DNS leak happens when your device sends DNS requests outside the tunnel — usually to your ISP's resolver — even though the VPN is connected. It defeats much of the point, because your ISP can rebuild the list of sites you visited from those lookups. Leaks come from operating-system quirks, badly configured apps, or a connection that briefly drops. Good VPNs prevent them by forcing all DNS through their own resolvers and by pairing that with a kill switch for the drop case. You can check with any reputable DNS-leak test site: if it shows your ISP's resolver while the VPN is on, something is leaking.

The other leak: WebRTC

There's a second, browser-specific leak worth knowing about. WebRTC is a feature browsers use for video calls and real-time connections, and it can sometimes reveal your real IP address to a website even with a VPN on, because it asks your device directly for its address. Many VPN apps and browser settings can block it; if you're relying on a VPN to mask your IP, it's worth confirming WebRTC isn't quietly undoing that.

Does a VPN hide your location?

A VPN hides the location implied by your IP address, so sites think you're where the server is — but it can't hide location you give away other ways, like GPS on your phone, location permissions you've granted, or an address in your account. So the honest answer is that a VPN changes your apparent network location, not your real-world one. For where this fits among a VPN's broader limits, see what a VPN is.

Shared IPs: hiding in the crowd

Most consumer VPNs put many users behind the same server IP address at once — a design called shared IPs. It's a privacy feature as much as a technical one: when hundreds of people share one address, any single request is far harder to trace back to you specifically, because that address doesn't belong to one person. It's the difference between a name tag and standing in a crowd.

This is also why a VPN IP behaves differently from your home one. A shared VPN address can trip "unusual login" warnings on some accounts, and it's more likely to hit a CAPTCHA, precisely because so many people use it. A dedicated IP — an address only you use, offered by some providers as an extra — avoids those hassles but trades away a little of the crowd-based anonymity. Which you want depends on whether you value blending in or a smoother experience.

The other address: IPv6 leaks

There are actually two kinds of IP address in use today: the older IPv4 and the newer IPv6. A VPN that only routes your IPv4 traffic can accidentally let IPv6 requests slip out over your normal connection, revealing an address that identifies you — an IPv6 leak. Good VPN apps handle this by either routing IPv6 through the tunnel too or disabling it while connected, but it's a real gap in weaker apps.

Put together, the address story has three leak points to watch: DNS requests going to the wrong resolver, WebRTC revealing your real IP in the browser, and IPv6 escaping the tunnel. A well-built VPN closes all three, and a kill switch covers the fourth case — a dropped connection. When people say a VPN "leaked," it's almost always one of these, not the encryption failing.

The reassuring part is that all four are solved problems: reputable apps handle DNS, WebRTC and IPv6 by default and include a kill switch, so you mostly just need to confirm they're switched on. A quick leak test after connecting is the simplest way to be sure your real address really is hidden.