PTR Queries Reverse Hostnames
A PTR lookup maps your public IP to a reverse hostname (in-addr.arpa / ip6.arpa). It does not reveal which recursive DNS resolver your browser uses, and having no PTR record is common.
WebRTC Observes Visible ICE Candidates
ICE/STUN probes check whether UDP traffic exposes a different public IP outside your HTTP proxy tunnel. Compare candidates only against HTTP exits of the same address family.
True DNS Leak Testing Requires Dedicated Authoritative Probes
DNS leak tests request random domains from the current browser and obtain actual recursive resolver addresses from the authoritative service. A and AAAA names are both probed. Missing queries, timeouts and unidentified resolvers remain pending; failure never implies a pass. PTR records, system DNS configuration and actual resolver exits are displayed separately.
How to Handle Observed Discrepancies
If WebRTC exposes a different public IP, enable TUN UDP forwarding or configure WebRTC IP handling policy in your browser.
Common Real-World Scenario
For example, a PTR record showing a cloud hostname and an empty WebRTC candidate list neither prove nor disprove whether your DNS queries traverse the proxy tunnel.
Choose a test by the question it can answer
To identify the recursive resolvers used for test domains, run the DNS leak test. To inspect additional browser connection candidates, use WebRTC testing. To retrieve the reverse hostname of a public IP, use PTR lookup. These answer different questions; a successful PTR lookup does not verify the DNS resolution path.
The number of observed test domains differs from the number of unique resolvers. Twelve domains may use one resolver, while several recursive nodes may query one domain. Review every domain status and the resolver list. For WebRTC, distinguish IPv4, IPv6, private addresses, and mDNS names rather than counting every candidate as a public leak.
For example, if the HTTP exit matches expectations but resolver evidence points to a domestic network, review browser secure-DNS and proxy DNS handling, then retest fresh random domains. If only WebRTC reveals another public address in the same family, investigate that candidate path. Do not disable several networking capabilities merely to make unrelated results look identical.
References & Freshness
The above is independent diagnostic guidance with no access to Anthropic internal risk controls. Policies, UIs, and support workflows may change—always verify against official effective dates and your account portal.