The first sign of a roof leak is rarely a drip from the ceiling. By the time water makes it through drywall, the leak has been active long enough for the deck to absorb, the insulation to wick, and the framing to start staining. The faster diagnostic happens in the attic — with a flashlight, after a rain — and reads the dark trails on rafters and sheathing before the water finds its way downstairs.
The hard part: water travels along framing. Where it enters the roof and where it shows up on the ceiling are almost never the same vertical line.
Why ceiling stains lie about location
Water on the underside of a roof deck doesn't fall straight down. It follows the path of least resistance — the underside of the sheathing, the top edge of a rafter, the seam where two sheets of plywood meet — until it hits a break. The break is usually a nail head, a low spot in the deck, or the joint where framing meets framing. At the break, the water finally drops.
That drop point can sit several feet from the actual entry. On a low-slope roof with rafters parallel to the eave, water can travel 10 or 12 feet before falling. Following the ceiling stain straight up to the roof and looking at the corresponding shingle is almost always pointing at the wrong place.
The right diagnostic — flashlight in the attic, after rain
Wait until the next rainstorm passes. Within 24 hours, while the wood is still showing the moisture, climb into the attic with a flashlight. Run the light across every rafter and the underside of every sheet of sheathing. What you're looking for:
- Dark trails on rafters — usually running from a high point downward, ending where the water dropped to the insulation
- Stains on sheathing — irregular dark patches, sometimes with white or rust-colored mineral deposits at the edge from prior soakings
- Wet or damp insulation — feel the top of the insulation under any stain location
- Light visible through the deck — a small but high-confidence signal that the underlayment is breached
Once you've found a drop point on a rafter or in the sheathing, trace upward and outward along the framing. The entry into the deck will be uphill of the drop point, often by several feet. Mark suspected entry zones with chalk from inside.
The most common leak locations
Chimney flashing. The single most common residential roof leak. Specifically: the back-of-chimney cricket (or the absence of one on chimneys over 30 inches wide), the step flashing along the sides, and the through-pan at the front. Chimney flashing fails by year 15-20 on most installs.
Valley centers. Where two roof slopes meet. Open metal valleys leak when the underlying ice-and-water shield was skipped or damaged. Closed-cut shingle valleys leak when the cuts were too aggressive or the underlayment didn't extend far enough.
Plumbing-vent boots. The rubber gasket around the plumbing vent stack cracks at year 8-12 — UV degrades the elastomer, the boot pulls away from the pipe, water enters. A $25 part causes more roof leaks than any other single failure mode.
Skylight perimeters. The flashing kit and the head-flashing detail are install-sensitive; bad installs leak within a few years, good installs run for decades.
Ice-dam zones. Eaves where ice damming forces meltwater up under the shingles. The fix is ice-and-water shield extending 24 inches past the interior wall line — code in most cold climates since the 2000s, but missing on older roofs.
Ridge cap. Wind lifts ridge cap shingles, water enters at the seam, runs down inside the deck.
What's rare: field-of-shingle leaks (the open expanse between penetrations). On a roof younger than 18-20 years, field leaks almost always trace to a missing shingle or storm damage.
The bag-of-water (or hose) isolation test
When the attic inspection points to a general area but not a specific entry point, a controlled water test isolates it. Two people, one garden hose at low pressure, working bottom-up by quadrant.
Start at the eaves on the suspect face. Run water for 5-10 minutes. The person inside the attic watches for water entry. If nothing shows, move up two feet and repeat. Then test valleys, then penetrations one at a time, then the ridge. The point is to not flood the whole roof — that defeats the diagnostic. A controlled test of one zone at a time finds the actual entry within an hour or two on most roofs.
Leak versus condensation — different problem, different fix
Some "leaks" aren't leaks. They're condensation from under-ventilation, and the visual signal is different: uniform staining across wide areas of sheathing, rust on every nail tip and connector, a musty smell, worse in winter than after summer storms. The fix isn't roof repair — it's adding intake and exhaust ventilation. See the ventilation guide for the diagnostic.
For the broader maintenance and lifespan framework, see the lifespan hub. For when a leak rises to a full replacement decision, see the replacement hub. When the cause is storm damage and the math is on the insurance side, see the storms and insurance hub.
This is reference, not a quote.