Unique names
For every test the server issues a random token and 6 or 36 names like 1-token.dnstest.limpvpn.info. No cache in the world knows them.
DNS Leak Test
Press “Run test”: your browser looks up several unique domain names, and our DNS server records which resolvers asked for them. In 5–10 seconds (longer in extended mode) you will know who handles your DNS queries and whether they leak outside your VPN.
Runs in your browser, nothing to install, no sign-up. We show each resolver's address, provider and country and keep nothing longer than 10 minutes.
The test shows the DNS servers your device uses to look up websites. Run it without a VPN, then with the VPN on, and compare.
Extended mode takes longer but catches resolvers that do not answer every query.
We keep the random test token, the resolvers that came with it and your address for 10 minutes, only to show your result. Resolver details come from local DB-IP databases (IP Geolocation by DB-IP) and are not sent anywhere.
How the test works
A browser never tells a website which DNS resolver it uses, so we look at the queries from the other side: from our own DNS server.
Lookup through your resolver
Your browser requests these names, so your DNS resolver has to ask our DNS server, which is authoritative for this zone.
Who showed up
Our server records the address each query came from. That is the resolver you actually use.
Compared with your connection
We compare the resolver's network with your address's network. Traffic through a VPN plus DNS through a regular provider means a leak.
When to test your DNS
Public Wi-Fi
In a café, hotel or airport the network hands you its DNS server. See whose it is and whether the network owner can see where you go.
Remote work
Make sure lookups for work services go through the company VPN, not through your home provider.
After setting up a VPN
Run the test with and without the VPN: with working protection the resolver switches to a server on the VPN's network.
Changing DNS
Changed DNS on your router or phone? The test shows whether the setting really took effect.
More LiMP tools
Free network, privacy and security checks right in your browser — no install, no sign-up.
- Is my VPN working
- Is a site down for everyone or just me
- Website availability from different countries
- Internet stability test
- Internet speed test
- Password generator
- Password strength and leak check
- Email breach check
- Link and website phishing check
- Wi-Fi security check
- Dependency audit & SBOM
- My IP address & footprint
What is a DNS leak
Before opening a website, your device asks a DNS server for the site's IP address. By default these questions go to your internet provider's DNS server: that is how most routers and mobile networks are set up. Every query contains a site name, so a DNS server's log is close to a full list of where you have been.
A VPN encrypts your traffic and routes it through its own server. But if DNS queries keep going straight to your provider, outside the tunnel, the provider still sees the names of the sites. That is a DNS leak: page content is protected, but the list of domains is not.
Why DNS leaks happen
Leaks almost always come from system, browser or network settings, not from the encryption itself. Typical causes:
- The VPN client does not change the system DNS server, or changes it only for some connections.
- By default, Windows may send queries over all network adapters at once and use the fastest answer.
- The browser has secure DNS (DoH) enabled with a manually chosen service, so that service, not your VPN's DNS, resolves the site names.
- Your provider or a public network owner intercepts DNS queries and answers them itself.
- After the VPN drops, the device falls back to the provider's DNS for a while.
- The VPN client protects only IPv4, while DNS queries over IPv6 go out directly.
How to read your DNS test results
The table lists the DNS servers that asked our server about the unique names from your test, with their provider and country. The “Whose server” column shows whether the resolver's network matches the network you opened this page from.
If you are on a VPN and every resolver belongs to its network, there is no leak. If a regular provider's server shows up, especially your home or mobile provider, that is a leak. Public DNS services are not a leak to your provider, but they see every query themselves, and if those queries travel outside the tunnel unencrypted, your provider sees them too.
Without a VPN the test almost always shows your provider's DNS. That is normal: most connections work this way. Compare it with the result you get with the VPN on.
How to fix a DNS leak
- Turn on DNS leak protection and a kill switch in your VPN client, if it has these options.
- In your browser, turn off secure DNS with a manually chosen service, or keep the default provider.
- If your VPN does not tunnel IPv6, disable IPv6 for the connection.
- Reconnect and run the test again in extended mode: some resolvers handle only some of the queries.
What data we store
For each test our server issues a random token and remembers for 10 minutes which resolvers asked about names with that token. Only the address that started the test can read its result, so no one else can read it. The token, the resolver addresses and your address are kept only to show the result and are deleted after 10 minutes. We do not link tests to accounts, do not put addresses into analytics and do not share them with third parties.
DNS leak FAQ
It is when your traffic goes through a VPN but DNS queries, which contain site names, go straight to your provider's DNS server. Page content stays encrypted, but the provider sees the list of domains you open.
Press “Run test” on this page without a VPN, then turn the VPN on and run it again. If your provider's server is still among the resolvers in the second test, DNS bypasses the tunnel.
That is how most connections work: routers and mobile networks send queries to the provider's DNS server by default. It is not an error or a leak; it simply means your provider sees which sites you open.
Standard sends 6 queries and takes 5–10 seconds. Extended sends 36: it takes longer but more reliably finds resolvers that handle only some of the queries, for example when the system has several DNS servers.
Your router, provider, browser or the VPN service itself may use them. In some countries Firefox turns on DNS over HTTPS via Cloudflare by default, and in Chrome and other browsers you can pick such a service in the secure DNS settings. Some providers also forward queries to public DNS.
No queries reached our server in time. Usually an ad or tracker blocker, a strict corporate network or a very slow resolver is to blame. Disable the blocker for this page and run the test again; if that does not help, try extended mode.
Only for 10 minutes and only to show the result to you: the random test token, the resolver addresses that came with it, and your address. Then the record is deleted. Your address never goes into logs or analytics.
In the LiMP app, DNS queries go inside the encrypted tunnel. You can check it with this test: connect and run it — your provider's servers should not appear in the table.