DNS Leak
When DNS queries escape your proxy tunnel, exposing which sites you visit to your ISP.
When you type example.com into your browser, the browser asks a DNS resolver (usually your ISP's) to translate the domain to an IP. If you're using a proxy that promises DNS privacy, all DNS queries should also go through the proxy. A DNS leak is when some queries escape — they reach your ISP's resolver, which logs the domain and (in some jurisdictions) sells the data.
Browsers cannot directly read the OS resolver, so a 'true' DNS leak test needs a native client. IPCombo observes the public side: it queries a DoH endpoint and a plain HTTPS endpoint, and compares the responses. If they differ, DNS is being rewritten somewhere in the path — usually by a transparent proxy or a misconfigured VPN.
The fix is to enable DNS-over-HTTPS in your browser (or system) and to confirm your proxy is configured to route all DNS — including the bootstrap IP for the DoH endpoint — through the tunnel. Most modern VPN clients do this automatically; older or DIY setups often miss it.