Expected VPN model
When a VPN is configured to carry a connection path, applications and DNS traffic may be expected to leave through the VPN environment. The exact behavior depends on the VPN client's routing and resolver configuration.
DNS leak concept
A DNS leak occurs when DNS queries use a resolver path outside the privacy or routing boundary the user expected. The destination web server can still see the VPN exit address while DNS infrastructure may reveal a different network relationship.
Useful signals
| Signal | What it can indicate |
|---|---|
| Observed public IP | Which egress address the destination service sees. |
| Resolver addresses | Which DNS infrastructure is handling queries. |
| ASN / provider | Whether the observed resolver or egress belongs to the expected network. |
| DNS query path | Whether requests appear to use a local ISP, public resolver, or VPN-provided resolver. |
Interpretation limits
Resolver choice alone does not reveal the complete privacy state of a connection. Split tunneling, browser behavior, operating-system settings, enterprise VPNs, and encrypted DNS can all change the visible pattern.
Privacy troubleshooting should therefore test the complete routing and DNS configuration rather than relying on a single lookup result.
Open DNS Analyzer →