A DNS leak test that shows a different country from your IP is often not a leak. A resolver is a leak only relative to where you browse from. A public anycast resolver one country over is ordinary. The resolver your proxy's exit node uses is the proxy's property, wherever it sits. The real leak is the resolver of your own connection, and that one can show up in the same country as your exit just as easily as in another.
Three readings of the same result
The test page has your browser look up a few hostnames nobody has asked for before, then checks its own name servers to see which resolvers came for them. You get an address, a company and a country per resolver. Who fetched the names is all that tells you. Whose resolver it was is the question, and it has three answers.
| What the test shows | Whose resolver it is | A leak? |
|---|---|---|
| A public resolver (Google, Cloudflare, Quad9) in a nearby country | Whoever chose that service, often the exit | No |
| Your own ISP, in your own country, behind a foreign exit | Your connection | Yes |
| Some other ISP or host, in a third country | The exit node's upstream | No, but scanners charge for it |
Only the middle row leaks, and it is the one row you can rule in or out in a minute: you know what your own ISP is called.
Why anycast puts the resolver in another country
Public resolvers are anycast: one address, announced from many sites, answered by whichever site is nearest by network routing. Nearest by routing is not nearest on a map. A query from one country can easily be served by the operator's site in the next one, and on a different day by a third. A country column next to an anycast address tells you where that query happened to land.
So a leak test listing Google in Germany for an exit in Austria, or the Netherlands for an exit in Belgium, has shown you an ordinary day on a public resolver.
Paste one gateway line. Every profile mints its own exitIn Mosaic: Provider minting. One gateway line, a separate exit for every profile. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it works: Provider minting
The exit's own resolver is the proxy's, not yours
With a proxy, the browser does not resolve the names it visits. It hands the hostname to the gateway, as a CONNECT request for HTTPS or as a domain name over SOCKS5, and the exit node resolves it with whatever resolver that node was set up with. No browser switch reaches that choice. (How to confirm the browser really sent a name and not an address is in a numeric CONNECT means DNS leaked.)
We measured it with no browser in the path. Plain curl through a residential session from one seller:
through the proxy resolver Google LLC, Germany, then the Netherlands
the exit itself Verizon, United States
this machine, direct resolver kabelplus, Austria
The exit was in the United States and its resolver was in Europe. The third row is what proves nothing leaked: had the lookups come from this machine, the test would have shown the Austrian ISP.
Once Mosaic's proxy check started reading the resolver on every check, we saw all three outcomes on real sessions. Exits in Guyana and Jamaica resolved through the Netherlands and Germany. Exits in Iraq and Laos resolved in their own countries. Twice the resolver could not be read at all.
What a VPN changes
A VPN works at the operating system, so the resolver is whatever the system uses while the tunnel is up. A VPN leak is the system sending its DNS queries outside the tunnel, to the ISP's resolver, and the test shows your ISP. That is the middle row again. The reading rule is the same for both: compare the resolver's ISP with your own.
Why a scanner still marks you down
Consistency scanners do not draw this distinction. Whoer docks a profile when the resolver's country differs from the IP's, and when we measured it, that was its largest single deduction. Six loads on one profile, one launch, no change in the browser: 100, 100, 100, 100, 35, 30. The drops arrived when the residential session rotated onto an exit whose resolver sat elsewhere. The score tracked the exit, not the browser, which the public resolver write-up goes through with the stock Chrome comparison that first misled us.
So a third-country resolver is not a leak and still costs points. The fix is not in the browser. It is a different pool or a different seller.
How Mosaic reports it
The proxy check sends one extra request through the same relay and asks edns.ip-api.com which resolver fetched a hostname nobody has looked up before. The result carries dnsCountryCode, dnsIsp and dnsMismatch, and a mismatch turns the banner amber with "a different country from the exit" and a note that another pool is the only fix. When the resolver cannot be read, all three fields stay empty, because "we did not find out" and "they agree" are different answers. The rest of what the check reads is in how to check a proxy before you use it.
Our detection runner reads BrowserLeaks' DNS page the same way. With no proxy it says there is nothing to leak, since the browsing and the lookups both leave from this computer. With a proxy it passes when the resolver is the exit's own address, and otherwise marks the row a fail, prints the resolver's ISP beside the exit, and leaves the judgement to whoever knows which ISP is theirs.
By hand it is three readings. Note your own resolver with the proxy off. Note the exit with it on. Run the test, and look for the first ISP's name in the list.
