DNS leaks: what a leak test actually shows

A DNS leak test observes which resolvers receive queries generated for the test. A resolver outside an expected VPN path can indicate a configuration issue, but the result alone does not prove that every DNS query or all application traffic follows that path.

What a DNS leak test actually measures

A DNS leak test generates controlled DNS queries and observes which resolvers handle them. If an unexpected resolver receives those queries while a VPN is active, the DNS path deserves investigation, but that result does not describe the route of all application traffic.

How to compare DNS before and after a VPN

Record the resolvers seen without the VPN, connect the VPN and repeat the test. If the ISP resolver still appears, check the VPN DNS settings, browser DNS and DoH. An unfamiliar resolver is not automatically a leak because a VPN may intentionally use a third-party DNS service. You can cross-check an individual DNS response with 2ip DNS response check, but that does not replace a leak test.

When an unfamiliar resolver is not a leak

Technical references: RFC 8484 and RFC 7858.