DNS leaks expose which domains you visit to your ISP even when web traffic is encrypted by a VPN. This test shows which DNS resolvers your system is using.
DNS translates domain names to IPs. If queries go to your ISP resolver instead of the VPN's, your browsing history is logged locally regardless of VPN encryption on HTTP traffic.
Pass: only VPN-provided DNS servers appear. Fail: ISP or third-party resolvers appear alongside or instead of VPN DNS.
DNS resolution happens at the OS level. Use this browser test or compare resolver output from your VPN client's diagnostics.
DoH encrypts queries but if configured to use a non-VPN resolver it can still leak metadata outside the tunnel.