What the test looks for
Before your device can reach a site, it asks a resolver to turn the name into an address. That question is DNS. By default the resolver is run by your internet provider, a public service, or your router. A DNS leak test shows which resolvers answered while you were connected through a proxy or tunnel.
If the answer shows your home provider while the service is on, your site names are going around the service. The pages you load may come via the proxy, but the list of sites you ask about is still visible to the provider.
Why proxies leak first
With a proxy, the browser usually hands the site name to the proxy. Leaks happen when an app resolves names on its own. Some clients can pass names to the proxy to look up there, and some leave it to the app. A tunnel in TUN mode is better placed: it takes DNS traffic with everything else. So the test discriminates between a setup that covers the app and one that covers the machine.
Browsers add a twist: some use their own encrypted DNS setting, which can override the system and send names to a public resolver you chose long ago.
Running the test
Run a DNS leak test with the service off and write down the resolver names.
Switch it on, wait a few seconds and run it again.
Compare the lists. New names should belong to the service's side, not to your provider.
If your provider appears, change the client to system-wide mode or turn on its DNS option.
Check the browser's secure DNS setting, and set it to follow the system or off.
Run a WebRTC check, since that is a separate gap.
Common causes of a leak
- The client works as a proxy only, with DNS left to the app.
- The browser has its own DNS provider selected.
- The phone uses a Private DNS setting that stays outside the tunnel.
- IPv6 queries go out the normal way while the tunnel handles only IPv4.
- A second network adapter, such as a hotspot or a virtual machine, takes a different route.
How to read the result
Do not count the number of servers shown. A test may list several resolvers even when all of them belong to the same provider, and one provider can run many addresses. Read the names of the companies. If every name belongs to a company other than your home provider, DNS is not going via your home network. Whether that company is a better choice is a trust matter, not a technical one.
A result is a snapshot of one moment on one network. Tests on mobile data and on Wi-Fi can differ.
Our position
There is no app of our own; a free client reads the VLESS link from the bot, and DNS handling is a setting of that client. If the test shows your provider, treat it as a setup problem to fix, not as a figure of speech.
As the seller, we cannot ask you to take the claim on faith, so the test is yours to run. The text was prepared with an AI model and read through by an editor against how the service works. Rules about using proxies and VPNs differ by country and network and change, so your own situation decides what is allowed.
Call log
01What is a DNS leak in plain words?
Your device asks an outside resolver for site names instead of the one belonging to the service.
02Does a leak mean someone hacked me?
No. It means a setup sends name lookups around the tunnel; the party who sees them is usually your provider.
03Is the test free?
Free test pages exist; you open one in a browser. Pick one and read what it shows, since each reports differently.
04Can I fix it on a phone?
Often yes: check the client's mode and the Private DNS setting in the system network options.
05Does the service keep my DNS lookups?
The service writes no logs of visits or connections. No test can confirm it, so treat it as a claim.
06Why do I see only one resolver?
Some setups use a single resolver. That is normal when it is the one you expect.
07Does a leak change my IP address?
No, the IP and DNS are separate. Run the IP check as well.