What a DNS Leak Test Can — and Cannot — Prove
DNS translates domain names into records such as IP addresses. A browser-only webpage cannot directly inspect every DNS request made by the operating system or other applications. A proper DNS audit therefore needs an observation point that can identify which recursive resolver asked for a test name.
Why an authoritative test domain is used
A robust test creates a one-time random hostname under a domain controlled by the test operator. When the visitor's recursive resolver looks up that name, the operator's authoritative nameserver can observe the source resolver address. Random labels help distinguish the current test from cached or unrelated lookups.
Why a DoH check is not a DNS leak test
Asking axtarish motoru or bulut hizmeti DNS-over-HTTPS to resolve a name only checks whether that HTTPS service is reachable and returns a DNS response. The request is intentionally sent to that provider. It does not reveal which resolver handled the user's ordinary system DNS traffic.
A resolver address can differ without proving a leak
Many VPN providers use separate DNS resolver infrastructure. A recursive resolver IP may not equal the VPN's HTTPS exit IP and may belong to a legitimate DNS provider. Interpret the operator, ASN, region and expected VPN DNS design instead of comparing IP strings alone.
DI VPN's current DNS audit status
DI VPN has an authoritative challenge-and-observation implementation, but it is deliberately disabled until the dedicated audit subdomain is delegated to a publicly reachable authoritative service over UDP and TCP port 53. Until that public infrastructure check succeeds, the DNS Leak Test reports that a conclusive audit is unavailable. It will not manufacture a green “no leak” result.
Recommended checks
Use the connection check for tunnel and Internet state, the IP check for the public address, and the DNS audit only when its authoritative observation is online.
Background reading: macvk/dnsleaktest and DNSLeakTester describe the need to observe DNS queries at an authoritative endpoint.
