v2rayNCommunity guide
← Back to blog
Security·8 min read·10 / 30

Check for DNS leaks with evidence, not a single green webpage

A DNS test must be interpreted against your selected resolver, mode and core logs. An unfamiliar resolver is not automatically a leak.

Steps

  1. Write down the resolver you expect: system DNS, a remote DoH endpoint or a resolver operated by the proxy service.
  2. Test system-proxy and TUN modes separately. Clear browser DNS state and use two independent test sites.
  3. Read core logs at the same time to see which DNS server handled the test name and whether its connection used direct or proxy.
  4. Check both IPv4 and IPv6. A policy that covers only IPv4 can leave an unexpected IPv6 path.

Why this matters

A webpage only reports what it can observe. Matching that result with logs and your intended topology distinguishes a real bypass from normal anycast infrastructure.

How to verify

Repeated tests match the intended policy, logs show no fallback to an unauthorized local resolver, and IPv4/IPv6 behave consistently.

Things to watch

Do not disable IPv6 or system DNS just to make a test page green. Identify the path, make the smallest correction and retest after upgrades.

Official references

System proxy and routing↗UI and advanced settings↗