Where Roof Leaks Actually Come From: Why the Stain Is Almost Never Under the Hole

The honest answer: it is almost never the shingles

When a homeowner calls us about a leak, the mental image is usually a hole. Something has broken through the roof, and water is falling through it onto the ceiling below.

That is not how most roofs leak. The large majority of leaks we diagnose across the GTA start at a penetration, a transition, or a piece of flashing, not in the open field of shingles. The field of a roof is the part that was designed and installed to do one job repeatedly across a large area. It is the simplest part of the system and it usually works. The leaks live at the awkward places: where the roof meets a chimney, where a slope runs into a wall, where a plumbing stack pokes through, where two planes meet in a valley, where a skylight interrupts everything.

The second thing to understand is that water travels. It enters at a defect, hits the underside of the deck or the top of a rafter, and then runs. Along a rafter it can travel several metres before finding a low point to drip from. Along the top of a ceiling it can spread further still and soak into drywall well away from where it landed. By the time it appears as a stain, the geometry has been thoroughly scrambled.

This is why the stain is almost never under the hole, and why a contractor who quotes a repair based on where the stain is has not diagnosed anything. They have guessed at a location. Sometimes the guess is right. When it is wrong, you get a repair that does not stop the leak, and the second contractor gets called, and then the third.

Where leaks actually start, ranked

This is the list we work through on a diagnostic, roughly ordered by how often each one turns out to be the culprit on GTA housing stock:

If a contractor looks at your ceiling stain and immediately proposes replacing the roof, they have skipped the entire top nine rows of this table.

Why flashing fails

Flashing is the metal that manages every place the roof plane is interrupted. When it is right, it outlasts the shingles around it. Here is why it so often is not:

• It was reused on the last reroof. This is the big one. Pulling old step and counter flashing out of siding and mortar is slow, careful work. Leaving it in place and shingling up to it is fast. That decision is invisible on the finished roof and it is a large part of why a low bid is low. Fifteen-year-old flashing under a brand new roof is a leak with a delay timer on it.
• Caulk was used instead of metal. Sealant is a finishing detail, not a flashing method. A bead of caulk where a proper counter flashing should be cut into the mortar will look fine for two years, crack in year three, and leak in year four. If you can see caulk doing structural water management on your roof, it is a defect.
• Chimney mortar has receded. Counter flashing gets cut into a mortar joint. Over decades the mortar weathers back, the flashing loses its seat, and water runs behind it. This is not an installation error, it is age, and it means the chimney needs repointing as part of the repair rather than the flashing alone.
• Laps run the wrong way. Water goes downhill. Every piece of flashing must be lapped so the upper piece sheds onto the lower one. A single reversed lap creates a funnel pointing directly into the assembly.
• The kick-out is missing. Where a roof slope ends against a wall, a kick-out flashing diverts water away from the cladding and into the gutter. It is a small, cheap piece of metal, it is routinely omitted, and its absence dumps every litre off that slope directly into the wall assembly. We have opened walls rotted through from a missing piece of metal the size of a hand.
• Nobody accounted for movement. Masonry, wood framing, and metal all move at different rates through Ontario's temperature swings. Flashing details that do not allow for differential movement work loose.

When you compare replacement quotes, flashing scope is one of the clearest signals of quality. New step, counter, valley, and drip edge as named line items is a contractor planning to do it properly. The phrase reuse existing where serviceable means reuse everything.

How to trace a leak to its source

This is the actual field method, and most of it happens indoors. A homeowner can do the first three steps safely and will often find the answer:

1. 01

   Record what the stain does, and when. Does it appear during rain, or hours after? Only in wind-driven rain from one direction? Only in winter? Only during a thaw? Only when the shower runs? These correlations narrow the cause faster than anything on the roof. Rain-correlated points at the roof. Cold-weather-only with no rain correlation points at condensation. Shower-correlated points at plumbing.

2. 02

   Go into the attic with a bright flashlight, while it is raining if possible. This is where the leak is visible and the ceiling is not. Look for active drips, dark staining on the sheathing, rust rings around nail points, water tracks running along the top of rafters, and matted or discoloured insulation. Wet insulation is a good marker even days later.

3. 03

   Follow the water uphill. Find the wettest point, then trace the staining up the slope. Water leaves a trail on wood. Keep going until the trail stops. That top point is at or very near the entry, and it is frequently metres from where you started. Note what is directly above it on the roof: a stack, a valley, a chimney, a skylight.

4. 04

   Correlate inside to outside. Measure from a fixed reference such as a gable wall so you can find the same spot on the roof surface. Now the roof inspection has a target instead of being a general walkover.

5. 05

   Water test, from the bottom up, with two people. One person on the roof with a garden hose, one in the attic watching. Start at the lowest suspected point and soak a small area for several minutes. If nothing, move up and repeat. The discipline is running one area at a time and giving it long enough. Flooding the whole roof at once tells you it leaks, which you already knew, and tells you nothing about where.

6. 06

   Only then, get on the roof. With a specific area identified, the physical inspection is looking for a specific defect rather than hoping something obvious presents itself.

The reason contractors skip this is that it takes time and produces no revenue on its own. It is also the only way to be right.

When it is not the roof at all

A meaningful share of the water-on-the-ceiling calls we take are not roof leaks. Diagnosing this correctly saves people from paying for roof work that fixes nothing. The main impostors:

• Condensation. The most commonly misdiagnosed of the lot. Warm moist indoor air reaches a cold attic, condenses on the sheathing and on nail points, and then drips or runs when it thaws. The signature is unmistakable once you know it: it happens in cold weather with no rain correlation, the moisture is diffuse across a broad area rather than concentrated at one point, and there is frost on the sheathing on cold mornings. The fix is air sealing and ventilation, not roofing. Our attic ventilation and insulation guide covers it in full.
• Plumbing. A supply line, drain, or wax ring in an upstairs bathroom. Correlates with fixture use rather than weather. Check whether the stain grows when nobody has run water for two days.
• HVAC condensate. An air conditioner or high-efficiency furnace with a blocked condensate line or a cracked drain pan, often in the attic or an upstairs closet. Appears in cooling season, correlates with the equipment running.
• Wind-driven rain at a wall opening. Water entering at a window head, a siding joint, a masonry crack, or failed caulking around a penetration, then travelling inside the wall and appearing at the ceiling below. The tell is that it only happens in heavy rain with wind from a particular direction. This is building envelope work rather than roofing, and it is a large part of what we do.
• A chimney with no cap or a cracked crown. Water entering the flue directly and appearing at the chimney chase inside. Nothing to do with the roof surface.
• An adjacent property. On semis and rowhouses, water crossing at a shared party wall or a neighbour's failed flashing. More common downtown and in the older Toronto neighbourhoods than people expect.

Any contractor worth hiring should be willing to tell you the problem is not theirs to fix. If every diagnosis a company produces happens to require the service they sell, that is worth noticing.

When thermal imaging and moisture scanning earn their keep

Most residential leaks are solved with a flashlight, a hose, and patience. Instruments are for the cases where visual inspection cannot reach the answer, and it is worth knowing which situation you are in before paying for them.

Infrared thermal imaging reads surface temperature. Wet insulation holds and releases heat differently from dry insulation, so a thermal scan taken at the right time of day, usually as the roof cools after sun exposure, maps moisture that is completely invisible to the eye. It also shows heat escaping through the ceiling plane, which is why the same survey that finds a wet spot also tells you where your attic is leaking warm air. It genuinely earns its place on flat and low-slope roofs with buried insulation, on large or commercial roofs where walking the whole surface guessing is not viable, and on any leak that has already survived one or more failed repairs.

Nuclear and capacitance moisture scanning goes further, quantifying moisture content across the roof area without cutting into the membrane. On a flat roof, the decision between a targeted repair and a full replacement usually comes down to a single number: what percentage of the insulation is wet. Below a threshold, cut out the wet sections and patch. Above it, you are patching a roof that is already lost. That number is worth measuring rather than estimating, because the difference between the two answers is often tens of thousands of dollars.

Core sampling is the destructive confirmation. A small cut through the assembly shows exactly what is in there, how many layers, and how wet. We use it to verify what the scan indicated before committing to a scope.

When instruments are not worth it: a straightforward sloped-roof leak on a house with an accessible attic, where twenty minutes with a flashlight will find the trail. We will tell you that rather than sell you a scan.

Roof leaks and insurance in Ontario

The question behind most leak calls is whether insurance will pay for it. The general shape of the answer in Ontario:

Sudden and accidental damage is typically covered. A windstorm tears shingles off and rain gets in. A branch comes through the roof. Hail bruises the surface. The event is identifiable, dated, and not your doing.

Gradual deterioration and deferred maintenance are typically not. A vent boot that cracked from UV over twelve years, flashing that receded with the mortar, a membrane at the end of its service life. Insurers treat these as maintenance, and they are usually right to.

Resulting damage is often treated differently from the cause. Even where the roof repair itself is not covered, the water damage to interior finishes and contents sometimes is, depending on the policy wording. It is worth asking the question specifically rather than assuming a no.

What actually determines the outcome, more than any of the above, is documentation. What an adjuster wants:

• Dated photographs of the damage and, where possible, of the condition before it
• A written diagnostic from a contractor that names the cause, not an invoice that says roof repair
• The repair scope and the estimate, itemized
• Evidence you acted promptly and mitigated, such as tarping, once you knew
• The permit record, if the roof has had work done. Unpermitted work can void coverage on its own

We write our diagnostics to be usable as claim documentation, and we state the cause honestly whichever way it falls. A report that says this is storm damage carries weight precisely because our reports also say, when it is true, that this is wear and no claim will succeed.

What a Blue Knight written diagnostic contains

Most roofing companies install. Very few properly diagnose, and the gap between those two things is where the repeat repairs live. A diagnostic from us includes:

• The interview and the correlation. When it leaks, in what conditions, what has already been tried and by whom. Five minutes of this eliminates half the possible causes.
• The attic inspection. Deck staining, rust at nail points, water tracks along rafters, insulation moisture, frost history. Traced uphill to the entry, not just observed at the drip.
• The roof inspection, targeted. Every penetration, transition, valley, and flashing detail in the identified area, photographed. Core sampling where the assembly needs to be confirmed.
• Instruments where they are warranted. Thermal imaging and moisture scanning on flat, low-slope, and previously-failed-repair roofs. Not as a default upsell.
• A named cause. The report says what is leaking and why, in plain language, with the photographs that support it. If it is not the roof, it says that too.
• An itemized scope and price. Repair option and replacement option where both are viable, with an honest statement of how many years the rest of the roof has left. HST included. The number on the estimate is the number on the invoice.
• Warranties in writing. The manufacturer's material warranty and our transferable workmanship warranty. They cover different failures and you want both.

The report is written to be handed to somebody else: an insurance adjuster, a property manager, a condo board, a buyer's lawyer. If you are dealing with an active leak anywhere in the GTA, call or book through the contact page. We prioritise active water same day.