Your proxy hides your IP. But before your browser opens any site, it first asks where that site lives. That question is a DNS lookup, and it can skip the proxy.
When it does, the site sees two things: the proxy's IP, and DNS servers from your real network. That's a DNS leak.
Checking takes 30 seconds.
What a DNS leak is
Every visit starts with a lookup. Your browser turns a name like example.com into an address, and a DNS server answers. Whoever answers learns which site you're about to open.
With a proxy, that lookup should happen on the proxy's side. If it happens on your computer instead, your own network answers it: your home ISP, your office or your VPN.
Leak tests catch this by making your browser look up a name only they control, then checking which DNS server comes asking. Any site can run the same check.
Why it matters
Your location shows through. A residential IP in Texas next to DNS servers from your provider in Germany doesn't look like a local visitor. Leak tests flag that mismatch, and so can anti-fraud checks.
Your provider sees every site. Each lookup tells your ISP, office or VPN which site you open, even though the traffic itself goes through the proxy.
Your local filters still apply. If your network blocks or fakes lookups for some sites, those sites break even through the proxy.
Check it in 30 seconds
Open the browser profile that uses the proxy. In it, open a DNS leak test: browserleaks.com/dns or dnsleaktest.com (run the Extended test).
Look at two things:
- The IP: it should be the proxy's, not yours.
- The DNS servers: none of them should belong to your own provider or network.
Google or Cloudflare servers in the list are normal: many networks use them. What matters is that your own provider doesn't show up.
Run it once for every new profile or setup.
If it leaks
The leak happens before the proxy: something on your side looked the name up instead of handing it over. Usual suspects:
- Firefox and Firefox-based browsers: "Proxy DNS when using SOCKS v5" must be on (Settings → Network Settings). It's on by default since Firefox 128. Check it on older versions.
- Apps that proxy your whole system, like Proxifier: set name resolution to go through the proxy.
Chrome itself always sends SOCKS5 lookups to the proxy. If a test still leaks, send our support a screenshot of the result and we'll help you find the cause.
On Elusive
Every lookup happens on the proxy side. Your browser sends the site's name, the proxy finds the address, and your own network never hears about it.
In the test above, every DNS server belongs to the carrier: the same ones a local user on that network gets.
Nothing to set up: no custom DNS, no extra options. A clean setup shows no trace of your provider in a leak test.