Short answer: A DNS server can appear in a different country from your VPN server because of anycast routing, public resolvers, VPN provider DNS infrastructure, browser Secure DNS, router DNS, or imperfect IP geolocation data.
Country mismatch alone is not proof of a leak. The stronger signal is ownership and intent: does the resolver belong to your VPN or chosen DNS provider, or does it point back to your ISP, router, workplace, school, or carrier?
Problem
- The country label is the weakest signal on this page. Resolver ownership is the one worth acting on.
- Anycast means one resolver address is answered from whichever site is nearest, so a country you never chose can be correct.
- This reads the resolver reached from this browser, which browser Secure DNS can set independently of the system.
Run the test
Start with DNS Leak Test. Keep the same browser and network when comparing before and after.
- Run DNS Leak Test before connecting the VPN and note resolver owner, ASN, and country.
- Connect the VPN and run the same DNS Leak Test again.
- Run VPN Leak Test to compare page IP, DNS, WebRTC, IPv6, and browser signals together.
- Check browser Secure DNS if only one browser shows the mismatch.
- Check VPN custom DNS, DNS leak protection, split tunneling, and router DNS if resolver owner is unexpected.
- Use Safe Copy after testing so the mismatch is documented without raw resolver IPs.
How to interpret results
| Result | Usually means | What to do next |
|---|---|---|
| VPN provider resolver | Often expected even if country differs. | Confirm this matches provider docs. |
| Chosen public resolver | Can be normal if you intentionally use it. | Document that browser/system Secure DNS is intentional. |
| ISP/router/workplace resolver | Stronger leak or misconfiguration signal. | Review VPN DNS protection, router DNS, and browser Secure DNS. |
| Only country differs | Could be anycast or geolocation mismatch. | Use owner/ASN and repeat tests before changing settings. |
| Different browser, different DNS | Browser-level Secure DNS or profile settings may differ. | Test the browser you actually use for the sensitive session. |
Do not judge by country alone
- Anycast DNS can route users to nearby infrastructure while databases label another country.
- Public DNS providers may show headquarters or regional labels.
- VPN providers may use centralized DNS instead of same-country DNS.
- A resolver owned by your real ISP while VPN is connected deserves more attention than country mismatch alone.
What to do after the result
This page exists because the country label is the weakest signal on the screen, and acting on it is how working setups get broken. Anycast means a single resolver address is answered by whichever site is nearest, so a provider's DNS can legitimately report a country you never selected. Before changing anything, look up who owns the resolver and compare that against your VPN provider's published DNS, rather than against the country you picked in the app.
Only two outcomes deserve a change. If the owner is your ISP, your router, or your workplace while the tunnel is up, the resolver path is not following the tunnel, and DNS leak protection or the adapter's DNS settings are where to look. If the owner is a public resolver you did not choose, something on the device selected it for you, and that is usually browser Secure DNS, which overrides the system resolver for one browser alone and explains a mismatch that shows up in one browser and not another. Every other combination, including a country that looks wrong, is normal and needs no action.
Frequently asked questions
Is DNS country mismatch always a leak?
No. Resolver ownership, chosen settings, and provider documentation matter more than country label alone.
When should I worry?
Worry more when the resolver belongs to your real ISP, router, office, school, or a provider you did not choose.
Can Secure DNS cause this?
Yes. Browser Secure DNS can use a resolver that differs from VPN DNS.
Limits and methodology
MyIPScan checks show observable browser and network signals for the current session. Results can change with browser profile, app route, VPN server, router, OS, carrier, DNS, and time. See the methodology and editorial policy.