Why a real DNS leak test needs specialist infrastructure
When you enter a domain name, your device normally asks a recursive DNS resolver to find the corresponding records. A privacy problem can occur when those DNS queries leave through a resolver you did not intend to use—for example, your normal ISP while you believe all traffic is using a VPN.
Ordinary browser JavaScript cannot reliably ask the operating system which recursive resolvers are handling every DNS request. A proper test creates unique hostnames, waits for those DNS queries to reach authoritative infrastructure and records which recursive resolvers contacted it. That observation requires dedicated DNS infrastructure.
What should you look for in the external result?
If you are connected to a VPN, compare the resolver organizations with the network you expected. Seeing your normal ISP's resolver can indicate that DNS traffic is not following the same privacy route as your web traffic. However, some users intentionally configure independent DNS providers, so a resolver that differs from the VPN is not automatically a leak.
Why DNS and public IP can tell different stories
Your browser's web traffic and DNS resolution are related but separate parts of the connection. A VPN can change the public IP seen by websites while DNS remains configured at the operating-system, browser or router level.
How to run a useful before-and-after check
Run the external DNS test before enabling a VPN and note the resolver organizations. Then connect the VPN and repeat it. The comparison is usually more informative than looking at one result in isolation.