One approved exit, or rejection
A fixed node selection does not guarantee a fixed public IP. Verify both the exact selected source and repeated observed egress. A proxy setting is not a block on direct traffic.
A strict workload boundary must constrain its actual identity to the approved endpoint and protocol, with other relevant egress denied by independently controlled enforcement. An application must not be able to rewrite its own protection.
- Verify original executables, children, IDE entries and delegated services.
- Keep ordinary software and remote recovery outside the scoped restriction.
- Do not import a generic firewall recipe without checking precedence and loopback support.
DNS and alternate protocols
Distinguish business DNS, resolver bootstrap and proxy-upstream bootstrap. Local HTTPS egress agreement does not establish the DNS path. IPv6, QUIC, UDP, STUN and TCP relay paths may behave differently.
The website does not operate a controlled authoritative DNS test, so the DNS weight remains uncovered. It does not upload a complete report or inspect local resolver files.
Failure and recovery
In a safe, authorized test boundary, verify normal use, an unavailable approved exit, resource refresh, network switching, sleep/wake and updated executables separately. Do not disconnect production protection to demonstrate a leak.
If no safe method exists, mark the case untested. Restore the scoped backup, read back the effective state and recheck the affected paths.