How to check your DNS is really encrypted

A leak test shows which resolver answered, not whether the query was encrypted getting there. The per-protocol commands that actually check it, with the real output and the traps that produce a wrong answer.

TL;DR

A leak test answers which resolver replied. Encryption happens on the hop between you and that resolver, which a leak test never observes.
Plaintext port 53 and DoH to the same resolver give an identical leak-test result. Both read as "not leaking"; one is not private on the local network.
Per-protocol checks with real output: DoH (code=200), DoH3 (http=3), DoT and DoQ via q, ECH via dig +short HTTPS, and DDR via dig SVCB _dns.resolver.arpa.
Firefox shows a DoH Status and Provider line; Chrome has no equivalent status page.
Three ways to a confident wrong answer, all of which look like a server fault: a TLS client that cannot do what you are testing for, testing with HEAD, and testing the wrong layer.

Full write-up: A Leak Test Cannot Tell You Whether Your DNS Was Encrypted.