Run randomized DNS lookups to identify resolver IPs, providers and locations, and check whether DNS requests bypass your proxy or VPN.
With a proxy or VPN, name lookups should travel through the tunnel too. If they still go straight to your ISP or system resolver, the ISP can see which domains you visit and you may get answers tailored to a different region than your proxy egress.
The page requests random subdomains from Surfshark, Fastly and BrowserLeaks; their authoritative DNS records which recursive resolver asked. Resolver countries are then compared with the browser's HTTP egress (IPv4 and IPv6). A resolver outside the egress country is flagged as a possible leak.
Not necessarily. The comparison works per country: if the proxy and your device are in the same country they cannot be told apart, and anycast public resolvers such as Google or Cloudflare may answer from a neighbouring region. If the browser uses secure DNS (DoH), the result covers only the browser; other apps may still leak.
Enable DNS hijacking or fake-ip in your proxy client so lookups resolve remotely, use TUN mode to capture system DNS, check that IPv6 DNS is not bypassing the tunnel, or enable secure DNS (DoH) in the browser over the proxy. Run the check again afterwards.