Cyber Metadata · DNS Leak Check
Record the resolvers that actually query DNS and compare them with your HTTP egress path.
This is a single check. Run the deep check to cover split egress, DNS/WebRTC leaks, VPN/proxy detection, AI/streaming reachability, and speed in one pass.
DNS 泄漏检测——你连了 VPN，但浏览器的 DNS 查询是否真的走了隧道？下面的检测会实测真正为你解析的递归 DNS 服务器，判断它是否落回了你的本地运营商。
你每打开一个网站，设备都要先做一次 DNS 查询，把域名解析成 IP。连上 VPN 后，这次查询本应也走加密隧道、由 VPN 指定的解析器完成。DNS 泄漏指的是：尽管你的网页流量走了 VPN，DNS 查询却绕过隧道、回落到本地运营商的解析器——于是你的真实运营商、所在地区，以及你正在访问哪些域名，都暴露给了本地 ISP。
我们用一次性随机子域触发解析，由自建权威 DNS 记录真正为你发起查询的递归解析器出口 IP，再判断它是否在隧道之外：
不是。IP 泄漏是你的真实出口 IP 被暴露（常见于 WebRTC、双栈分流）；DNS 泄漏是解析这一步绕过了隧道。两者可独立发生——想一次看全，用完整深度检测。
会，而且最隐蔽。本工具已支持这种情形：只要为你解析的递归服务器落在消费级 ISP 网络（你的本地运营商），即便它和你的出口同国，也会被标记为泄漏。
最常见的原因是客户端没开 DNS 泄漏保护、系统写死了本地 DNS、或 IPv6 未被隧道覆盖。
不一定。若浏览器或系统启用了 DNS-over-HTTPS（如 Firefox 默认的 Cloudflare DoH），DNS 走加密直连、绕过系统解析器，这类基于「递归解析器捕获」的检测可能观测不到本地 ISP——这是所有同类工具的共性盲区。
检测显示泄漏，想进一步知道你的出口是否被识别为代理、AI 是否可用、是否存在 WebRTC / 双栈泄漏？运行完整深度检测，或单独做分流与泄漏诊断。
DNS leak test — you connected a VPN, but is your browser's DNS query actually going through the tunnel? The check below measures the recursive DNS server that really resolves for you and tells you whether it fell back to your local ISP.
Every site you open starts with a DNS query that resolves the domain to an IP. Behind a VPN, that query should also travel the encrypted tunnel and be answered by the VPN's resolver. A DNS leak is when your web traffic uses the VPN but the DNS query bypasses the tunnel and falls back to your local ISP's resolver — exposing your real ISP, your region, and which domains you visit to that ISP.
We trigger resolution of a one-time random subdomain and let our own authoritative DNS record the recursive resolver IP that actually queries on your behalf, then decide whether it sits outside the tunnel:
No. An IP leak exposes your real exit IP (often via WebRTC or dual-stack split routing); a DNS leak is the resolution step bypassing the tunnel. They happen independently — to see everything at once, run the full deep check.
Yes, and it is the most subtle case. This tool handles it: whenever the recursive resolver sits on a consumer ISP network (your local ISP), it is flagged as a leak even if it is in the same country as your exit.
Usually because DNS leak protection is off, the OS hard-codes a local DNS, or IPv6 is not covered by the tunnel.
Not always. If the browser or OS uses DNS-over-HTTPS (e.g. Firefox's default Cloudflare DoH), DNS goes over an encrypted direct connection that bypasses the system resolver, so a "recursive-resolver capture" test may not observe the local ISP — a blind spot shared by all tools of this kind.
If a leak shows up and you want to know whether your exit is seen as a proxy, whether AI is usable, or whether there is a WebRTC / dual-stack leak, run the full deep check, or do the split-routing diagnosis on its own.