Run a focused DNS leak test, compare resolver owner before and after VPN changes, and understand whether a mismatch is a real review item or normal resolver routing.
This is a limited resolver-signal diagnostic. It queries public DNS-over-HTTPS resolver-signal endpoints and a MyIPScan DNS Lookup API control. It is not authoritative DNS capture, and a low-review result does not prove every DNS route was checked.
DNS privacy check
Short answer
If your VPN is connected and DNS still goes to your ISP, router, or an unexpected browser Secure DNS provider, that is worth reviewing. If only the country label differs, it may be anycast, resolver routing, or database mismatch rather than a leak.
| Result | Likely meaning | Next step |
|---|---|---|
| Resolver is VPN provider | Usually expected when the VPN controls DNS. | Run VPN, WebRTC, and IPv6 checks before calling the setup clean. |
| Resolver is ISP/router | Possible DNS leak while VPN is connected. | Review VPN DNS leak protection, Windows adapter DNS, and split tunneling. |
| Resolver is public DNS you chose | May be intentional browser Secure DNS or system DNS. | Document it in the receipt and check whether it matches your goal. |
| Country differs only | Not automatically a leak; anycast and geolocation can differ. | Focus on resolver owner and route intent. |
DNS leak test checklist
Use the first run as a baseline, then reconnect the VPN or change Secure DNS and run the DNS leak test again. The useful comparison is whether resolver ownership moved from your ISP, router, or browser Secure DNS provider to the route you expected.
When to investigate
Review the setup when the resolver still belongs to your ISP or router while the VPN is connected, when browser Secure DNS bypasses the route you expected, or when the result changes between normal and private browser profiles.
Then check VPN DNS leak protection, split tunneling, operating-system DNS settings, browser Secure DNS, and router DNS in that order.
A DNS review flag means the visible resolver signal may not match what you expected. It is not automatic proof of harm. Receipt exports use safe categories and remove raw resolver IPs and other sensitive diagnostic identifiers. Read the methodology.
See what Safe Copy includes before sharing or saving a result.
Combine IP, WebRTC, IPv6, DNS leak, fingerprint, user-agent, and related privacy signals in one report.
DNS turns a domain name into the IP address your browser needs to connect. This page can show resolver signals returned by public browser-accessible DoH endpoints and whether the MyIPScan server-side DNS control is reachable.
Unknown, IPv6, or inconsistent resolver signals may be worth checking against your expected VPN or secure-DNS route. They are not automatic proof of a problem.
This page cannot see every DNS request made by your operating system, router, VPN app, browser secure-DNS setting, or other apps. It also cannot observe authoritative DNS query logs for randomized test domains.
Use the result as a practical signal, then compare it with your VPN app settings and a second network or browser when the signal looks inconsistent.
The browser queries public DNS-over-HTTPS resolver-signal endpoints. The page labels known public resolver patterns, unknown signals, IPv6 resolver signals, and endpoint failures with conservative statuses.
The page also calls the existing MyIPScan DNS Lookup API for a harmless control lookup. That API uses a free public DoH resolver and helps separate "DNS lookup API is reachable" from "browser resolver signal is visible."
Before / after VPN
Run the check before changing VPN or secure-DNS settings, save the result, then reconnect your VPN and run the check again. The comparison stays in memory for this page session only.
Fixes
These steps can help when DNS signals do not match the route you expected.
Related tools
Related guides
Before / after privacy flow
This page is focused on browser-visible resolver signals and resolver-owner mismatch. Run the focused DNS check first, then use Public Exposure Report when IP, WebRTC, IPv6, and fingerprint context also matters. Results are visible browser/session signals, not a certification.
Status language
These labels keep the result understandable without implying a VPN, browser, device, or account is safe.
A browser/session signal was visible and should be compared with what you expected.
The observed signal appears consistent with the stated route or browser behavior.
The signal may need closer review before relying on this setup for the current session.
The check ran, but this page cannot cover every app, device route, server, or future connection.
The tested signal was not observed in this browser/session.
The signal has not run yet or the browser did not provide enough data.
Fix checklist
Settings names change. Treat this as a route to verify, then rerun the focused check and the Public Exposure Report.
Check DNS
Visible DNS resolver signals, including resolver owner, route expectations, browser Secure DNS behavior, and mismatches between DNS and the visible IP route.
Limits
It cannot see every DNS request from every app, inspect router or ISP logs, or prove that all browsing destinations are private.
Read results
A good result means the resolver owner matches the route you expected, or the result explains a known provider or anycast mismatch without an ISP/router resolver appearing unexpectedly.
Warnings
A warning means DNS may still be routed through an ISP, router, browser Secure DNS provider, or resolver path you did not expect while testing.
Fix path
Review VPN DNS settings, browser Secure DNS, router DNS, and split-tunnel rules. Country labels alone can be misleading because DNS uses anycast and shared infrastructure.
Retest
Retest after reconnecting the VPN, changing Secure DNS, changing router DNS, switching browser profiles, or moving to another network.