mDNS
mDNS is a local-network name protocol. Browsers use mDNS names like xxxx.local to hide your private IP in WebRTC candidates.
What mDNS is
Multicast DNS lets devices on the same local network find each other by name without a DNS server. A printer announces itself as printer.local, a laptop as laptop.local, and queries are sent to a multicast address that every device on the network listens to. It is the technology under Apple's Bonjour and under most "discover devices on your network" features.
Why it appears in browser tests
Until 2019, WebRTC candidate gathering exposed your private LAN address, for example 192.168.1.20, to any web page. That address is not routable from the internet, but it is a persistent identifier within a home or office and a hint about the network layout. Browsers now hide it: instead of the private address, the candidate contains a randomly generated mDNS hostname such as 3f2a9c1e-7b4d-4e1a-9f0c-2d5b8a6e4c1f.local. A peer on the same network can resolve that name with mDNS; a web page on the internet cannot, so the private address stays hidden.
The random name is regenerated per origin and per session, so it does not work as a tracking identifier either.
Why it matters
If the WebRTC leak test shows a .local name instead of a 192.168.x.x or 10.x.x.x address, that is the modern, expected behavior and not a leak. What still matters is the public candidate obtained through STUN: if it reveals an address that differs from your proxy, you have a real WebRTC leak regardless of what the local candidate looks like.
Older browsers, some embedded browser engines, and browsers with the mDNS obfuscation switched off still expose the raw private address. Seeing one is a sign that the browser is out of date or unusually configured, which is itself a fingerprinting signal.
How to check
Run the WebRTC leak test. Local candidates are listed separately from public ones, with mDNS names identified as such. The browser fingerprint page notes whether WebRTC is enabled at all.
A common misconception
An mDNS name in your candidates is not an address and cannot be looked up by the website. It is safe to see it there. The address to watch is the public one.