Follow the resolver choice
VPN profiles, operating system settings, browsers and local networks may influence DNS behavior. The intended resolver needs to be reachable through the route your setup provides.
Check IPv6 deliberately
A profile that routes one address family may leave another outside the tunnel. Decide the intended behavior, configure it deliberately and test it on the actual client platform.
Do not infer a certification
The project does not claim an independent DNS leak audit or a production kill switch. Document actual observed behavior and treat each device and platform as a separate validation target.