Distinguish the resolver from the route

DNS converts domain names into addresses. A website connection and its DNS lookup can take different routes. DoH encrypts the lookup transport; routing still decides whether it passes through a proxy. A resolver name or country shown on a test page is insufficient on its own to establish a leak. Compare it with your configured resolvers and routing policy.

Rule mode permits selected destinations to connect directly, so a corresponding local lookup may be intentional. To inspect strict proxy use, first confirm that TUN is enabled, select Global mode and check that the home screen reports the direct-connection guard as active. Compare results taken under the same mode.

Generate a query you can inspect locally

After connecting, open Logs → Core → DNS. On Windows, run nslookup example.com in a terminal and look for the corresponding timestamp. The command also works on other desktop systems where nslookup is installed. Check the connection destination, route and matching rule against your DNS settings rather than treating any returned address as a successful privacy test.

With fake-ip enabled, an address in 198.18.0.0/15 can be a normal internal mapping, not the location of the website's server. Caching can change what you see on repeated lookups; try example.org if needed. A successful query or a fake-ip response alone cannot establish that every DNS query is protected.

Read browser tests alongside local evidence

A trustworthy DNS test page can provide another view of the resolvers used by that browser. Built-in secure DNS, extensions and separate proxy settings can alter its route, however. Note those settings and compare the result with client logs. A browser test does not cover background services or every other application.

For unexpected results, check the mode, remote and local DNS settings and application bypass rules, then look for another proxy or VPN handling traffic at the same time. Keep only the local records needed for the check. There is no need to publish complete logs, subscription URLs or packet captures.

How godusevpn coordinates DNS protection

godusevpn sends remote DoH through the proxy. Local DoH handles direct destinations and node hostnames according to policy, while the core intercepts DNS protocol traffic and port 53. On macOS, it also takes control of system DNS while connected so the system does not keep querying a router outside the tunnel.

Strict Global mode still needs a way to resolve the node hostname before the tunnel exists. The configuration builder replaces the system resolver in that role with DoH reached by IP address. That bootstrap lookup serves a different purpose from remote DNS for ordinary destinations. Checking these paths gives you a stronger basis for judging your settings than a single green test result.