DNS leak test
Which resolver actually answers your DNS queries, and is it in the same network as your exit address? A resolver elsewhere means DNS bypasses the proxy.
How to stop DNS from leaking
Proxy users
Let the proxy resolve names: SOCKS5 with remote DNS (socks5h://), or an HTTP CONNECT proxy, which never sees a bare hostname lookup. Anti-detect browsers usually call this “DNS through proxy”.
VPN users
Use the VPN’s own resolver and turn on its DNS leak protection, so the operating system cannot fall back to the ISP resolver when the tunnel hiccups.
Browser-level DNS
Chrome: Settings → Privacy → Security → “Use secure DNS” with a chosen provider. Firefox: network.trr.mode = 3 for DNS over HTTPS only. Note that a public resolver hides the ISP but is itself a stable trait, and Google forwards your subnet (ECS).
Reading the result
A resolver in the exit network or country is the expected picture. A resolver in another country, or a forwarded client subnet that is not the exit network, reveals where you really are.
How this test works
The page asks the browser to connect to a few random names under a zone whose authoritative name server we run. Nobody has these names cached, so whichever recursive resolver serves this browser has to ask our server, and our server logs who asked and what the query contained: transport, EDNS options such as the client subnet, DNSSEC flags, case randomisation. The connection attempt itself is expected to fail; the lookup has already happened by then.