DNS leak check: what it proves

• Every connection starts with a name lookup: your device asks a resolver to turn a site name into an address.
• A dns leak means that question went to your home provider while the traffic itself went through the tunnel.
• The traffic stays encrypted either way. What leaks is the list of names, which is often the part people care about.
• A dns leak test works by asking you to load records from several random subdomains and reporting which resolvers came to fetch them.
• Reading the result is simple: resolvers that belong to your home provider mean a leak, resolvers in the same country as your chosen server usually mean no leak.
• Three causes cover nearly all cases: a client in proxy mode rather than tunnel mode, an IPv6 route the tunnel does not carry, and an app with its own resolver built in.

Names are the cheapest surveillance there is. A provider that sees your lookups does not need to read a single byte of your traffic to know which bank you use, which clinic you visited the website of and which streaming service you were browsing at midnight. That is why a check dns leak search usually follows a privacy decision rather than a technical fault: the tunnel is working, and the thing it was bought for is not.

The mechanics are unglamorous. Your operating system keeps a list of resolvers it trusts, handed to it by the network. A tunnel is supposed to replace that list for as long as it is up. When a client only redirects browser traffic, or when the system quietly keeps a second resolver for a second network interface, the old list is still in play and every name still goes out the front door.

• First 5 days free, no card, no account.
• 1 month: $4.90.
• 6 months: $3.90 a month, taken once as $23.40.
• 12 months: $3.20 a month, taken once as $38.40.
• 24 months: $2.90 a month, taken once as $69.60.
• Lookups travel inside the tunnel on all terms, and one key covers 5 devices across six locations.
• Cards, Apple Pay, Google Pay or crypto in the bot. No automatic renewal.

First, proxy mode. On Windows, a client set to system proxy covers browsers and little else, and name lookups from everything outside the browser carry on as normal. Switching the client to tunnel mode, often labeled TUN, fixes it in one click. Second, IPv6. If your provider gives you an IPv6 address and the tunnel only carries IPv4, some lookups take the IPv6 path around it. Turning off IPv6 on the adapter, or using a client that routes both, ends that one.

Third, applications that ship their own resolver. Browsers with encrypted lookups enabled talk to a resolver of their own choosing, which is not your provider but is also not our server. It is not really a leak, but it will show up as an unfamiliar name in a test result and it confuses people for an hour.

• A clean result proves the lookups are going the right way at that moment. It says nothing about the rest of your privacy.
• Test pages sometimes show several resolvers in one result. That is normal: large operators run pools and any of them can answer.
• A test run in a browser tests that browser. An app with its own network code can behave differently on the same device.
• Clearing the local cache matters. Names your device already remembers are not looked up again, so a fresh test needs fresh names, which is what the random subdomains are for.