# DNS leak test shows a different country? Read the ISP > Our US exit resolved through Google in Germany, and nothing leaked. A foreign resolver in a DNS leak test matters only if it is your own ISP's. Source: https://mosaicbrowser.com/blog/dns-leak-test-different-country ## A DNS server in another country is not always a leak Our US exit resolved through Google in Germany, and nothing leaked. A foreign resolver in a DNS leak test matters only if it is your own ISP's. ![3: A resolver is a leak only next to your exit, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/dns-leak-test-different-country.webp) A DNS leak test that shows a different country from your IP is often not a leak. A resolver is a leak only relative to where you browse from. A public anycast resolver one country over is ordinary. The resolver your proxy's exit node uses is the proxy's property, wherever it sits. The real leak is the resolver of your own connection, and that one can show up in the same country as your exit just as easily as in another. ## Three readings of the same result The test page has your browser look up a few hostnames nobody has asked for before, then checks its own name servers to see which resolvers came for them. You get an address, a company and a country per resolver. Who fetched the names is all that tells you. Whose resolver it was is the question, and it has three answers. | What the test shows | Whose resolver it is | A leak? | | --- | --- | --- | | A public resolver (Google, Cloudflare, Quad9) in a nearby country | Whoever chose that service, often the exit | No | | Your own ISP, in your own country, behind a foreign exit | Your connection | Yes | | Some other ISP or host, in a third country | The exit node's upstream | No, but scanners charge for it | Only the middle row leaks, and it is the one row you can rule in or out in a minute: you know what your own ISP is called. ## Why anycast puts the resolver in another country Public resolvers are anycast: one address, announced from many sites, answered by whichever site is nearest by network routing. Nearest by routing is not nearest on a map. A query from one country can easily be served by the operator's site in the next one, and on a different day by a third. A country column next to an anycast address tells you where that query happened to land. So a leak test listing Google in Germany for an exit in Austria, or the Netherlands for an exit in Belgium, has shown you an ordinary day on a public resolver. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## The exit's own resolver is the proxy's, not yours With a proxy, the browser does not resolve the names it visits. It hands the hostname to the gateway, as a `CONNECT` request for HTTPS or as a domain name over SOCKS5, and the exit node resolves it with whatever resolver that node was set up with. No browser switch reaches that choice. (How to confirm the browser really sent a name and not an address is in [a numeric CONNECT means DNS leaked](https://mosaicbrowser.com/blog/a-numeric-connect-means-dns-leaked).) We measured it with no browser in the path. Plain `curl` through a residential session from one seller: ``` through the proxy resolver Google LLC, Germany, then the Netherlands the exit itself Verizon, United States this machine, direct resolver kabelplus, Austria ``` The exit was in the United States and its resolver was in Europe. The third row is what proves nothing leaked: had the lookups come from this machine, the test would have shown the Austrian ISP. Once Mosaic's proxy check started reading the resolver on every check, we saw all three outcomes on real sessions. Exits in Guyana and Jamaica resolved through the Netherlands and Germany. Exits in Iraq and Laos resolved in their own countries. Twice the resolver could not be read at all. ## What a VPN changes A VPN works at the operating system, so the resolver is whatever the system uses while the tunnel is up. A VPN leak is the system sending its DNS queries outside the tunnel, to the ISP's resolver, and the test shows your ISP. That is the middle row again. The reading rule is the same for both: compare the resolver's ISP with your own. ## Why a scanner still marks you down Consistency scanners do not draw this distinction. Whoer docks a profile when the resolver's country differs from the IP's, and when we measured it, that was its largest single deduction. Six loads on one profile, one launch, no change in the browser: 100, 100, 100, 100, 35, 30. The drops arrived when the residential session rotated onto an exit whose resolver sat elsewhere. The score tracked the exit, not the browser, which [the public resolver write-up](https://mosaicbrowser.com/blog/is-a-public-resolver-a-leak) goes through with the stock Chrome comparison that first misled us. So a third-country resolver is not a leak and still costs points. The fix is not in the browser. It is a different pool or a different seller. ## How Mosaic reports it ![A proxy check result in Mosaic with exit address, ISP and tunnel status](https://mosaicbrowser.com/shots/proxy-check.png) *The proxy check, which also reads the exit's resolver* The proxy check sends one extra request through the same relay and asks `edns.ip-api.com` which resolver fetched a hostname nobody has looked up before. The result carries `dnsCountryCode`, `dnsIsp` and `dnsMismatch`, and a mismatch turns the banner amber with "a different country from the exit" and a note that another pool is the only fix. When the resolver cannot be read, all three fields stay empty, because "we did not find out" and "they agree" are different answers. The rest of what the check reads is in [how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it). Our detection runner reads BrowserLeaks' DNS page the same way. With no proxy it says there is nothing to leak, since the browsing and the lookups both leave from this computer. With a proxy it passes when the resolver is the exit's own address, and otherwise marks the row a fail, prints the resolver's ISP beside the exit, and leaves the judgement to whoever knows which ISP is theirs. By hand it is three readings. Note your own resolver with the proxy off. Note the exit with it on. Run the test, and look for the first ISP's name in the list. ## Questions ### Why does my DNS leak test show a different country from my IP? Most often because the resolver is a public anycast service, answered by whichever of its sites is nearest by routing, or because your proxy's exit node uses a resolver of its own that sits elsewhere. Neither is your connection, so neither is a leak. ### When is a DNS server in a leak test a real leak? When it belongs to the network you are trying not to show: your home or office ISP's resolver, or the one your computer uses with the proxy off. Compare the ISP name; the country alone misleads. ### Can a DNS leak show the same country as my exit? Yes. If your proxy exits in your own country, your ISP's resolver matches the exit's country perfectly and is still a leak. That is why a rule over country codes alone gets it wrong. ### Can I make my proxy use a resolver in the exit's country? Not from the browser. With a proxy the browser hands the hostname to the gateway, and the exit node resolves it with the resolver it is set up with. Another pool or another seller is the only fix. ## Related [Is a Google DNS server in your leak test a leak?](https://mosaicbrowser.com/blog/is-a-public-resolver-a-leak): Google DNS in a leak test is not a leak by itself. It depends on where you browse from: the resolver your own ISP runs is the leak, someone else's is not. [A CONNECT to a raw IP means your machine resolved the name](https://mosaicbrowser.com/blog/a-numeric-connect-means-dns-leaked): To check if DNS goes through your proxy, read what the proxy is asked for. CONNECT example.com:443 means it resolved the name; a raw IP means you did. [socks5 and socks5h: where Chrome resolves the name](https://mosaicbrowser.com/blog/socks5-and-socks5h-in-chrome): In curl, socks5h sends the hostname to the proxy and socks5 resolves it locally. Chrome's socks5 already sends the name; the leak is elsewhere. [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [What DNS over HTTPS changes when a browser uses a proxy](https://mosaicbrowser.com/blog/dns-over-https-with-a-proxy): Does DNS over HTTPS work with a proxy? Through one, the exit resolves each hostname, so Chrome's DoH setting covers only lookups the browser makes itself.    ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.