A DNS leak means resolution left through another egress
A DNS leak means resolution did not leave through the egress you expected. This page separates that from page egress and WebRTC, and shows how to read the DNS egress page.
Updated · Egress Observatory
Three checks, three different things
Page egress: where HTTP leaves. The home page and the split-egress page show this.
DNS egress: where resolution lands. The DNS page groups results by probe source. The HTTP egress is only a reference, not a binding for every lookup.
WebRTC: the browser's UDP candidates. That is not the same check as DNS resolution.
While you read it
If resolver egress does not match the proxy egress you expected, check whether those names are set to connect directly.
fake-ip or redir-host changes how the client handles resolution. You still have to look at the address the resolver actually left from.
This site does not read your client config. It only reports the resolver egress this probe reached.
How this relates to a shared report
A report created from the home page stores that domestic / overseas comparison and the quality score. DNS and WebRTC stay marked unchecked when they were not in the summary.
Unchecked does not mean there was no leak. To show someone the resolver result, open the DNS page. A /r/ link is the egress summary from that moment.