DNS leak
Before connecting anywhere, the browser asks a DNS resolver for the address. Here it resolves 6 one-off hostnames and our authoritative DNS server notes who asked. That is the resolver you actually use.
- DNS leak
- DNS resolvers
- Test hostnames resolved
- Exit country
- IP
- Test zone
- —
The resolver sees every hostname you visit. Ideally it sits in the same country as your exit IP (i.e. it is the DNS on the proxy / VPN side). If the resolver is in your local ISP's country while the exit IP is abroad, DNS queries are not going through the proxy: the ISP still sees every site you open and websites can infer your real location. That is a DNS leak. A country mismatch is the most reliable signal: the resolver's ASN may belong to a public DNS such as Cloudflare or Google, but if its node is local the query still originates locally. Fixes: enable DNS hijacking or fake-ip mode in Clash / Surge / sing-box so port-53 and DoH traffic goes through the proxy; for system VPNs tick "block DNS leaks / use the VPN's DNS"; and if the browser's secure DNS (DoH) points at a domestic provider it bypasses the proxy too; switch it to a proxied DoH endpoint or turn it off.