What is a DNS leak?
A DNS leak usually means web traffic goes through a proxy or encrypted tunnel while DNS queries are still sent by the local ISP, router or a resolver in another region. A target site or CDN may then see a location that disagrees with the public egress.
It is not always a binary problem. Public DNS, enterprise DNS and a resolver in the target region can all produce a different DNS egress.
How does the check work?
The page sends a query to the site’s EDNS probe. The probe reads the client subnet and the DNS egress that made the request, then adds location and operator data.
EDNS probing can only run on the machine that makes the lookup. When the site is deployed remotely, the result is the server’s DNS egress and is labelled “server perspective”; only a local run reflects your own network.
How do I read the result?
If the DNS egress and public egress are in the same country and share the same operator, there is usually no obvious leak signal. If DNS is in another country or a completely different network, third-party DNS, proxy DNS or split routing may be involved.
A different public DNS in the same country is not necessarily a leak; read it together with your actual network configuration.
How can I troubleshoot DNS?
Check DNS settings on the router, operating system and browser; confirm whether the proxy covers DNS, whether IPv6 bypasses it, and whether secure DNS or a corporate policy is active. Retest and record the before/after difference.
If you are also concerned about address exposure, run the WebRTC leak test.
Frequently asked questions
Does this show my DNS query history?
No. It only reads the DNS egress and EDNS subnet information for this probe; it does not display your past queries.
Why does it say “server perspective”?
EDNS probing can only run on the machine making the lookup. A remote deployment reports the server’s DNS egress; a local run reflects your own network.
Is a foreign DNS always a leak?
No. You may intentionally use public or enterprise DNS. Interpret it together with your proxy, routing and DNS configuration.
How does DNS relate to VPN detection?
A DNS location that disagrees with the public egress adds another consistency signal. Read DNS, WebRTC and the egress IP together.
Check DNS and WebRTC together
Two leak paths can give different answers. Start with DNS egress, then browser candidates, then return to the egress IP for a consistency check.