A VPN is one of the few privacy tools that does roughly what it promises — most of the time. Then a DNS request leaves your machine unencrypted, or the tunnel drops for three seconds and your real IP quietly reappears, and the protection you paid for is worth less than you assumed. None of this requires a broken VPN. It usually requires one that was never configured properly, which is far more common than a genuinely faulty product.

DNS leaks: the traffic that ignores the tunnel

Every connection starts with a name lookup. Before your browser can reach a site, your device has to translate the domain into an IP address — and that lookup often goes to whatever resolver your network handed you: your ISP, the hotel router, your mobile carrier. The tunnel encrypts your web traffic, and the name requests travel around it, in the clear. Anyone watching the network sees the domains you visit even though the pages themselves are hidden.

The fix is usually a single setting. Most clients offer something like “Use VPN DNS” or “DNS leak protection.” Turn it on, then verify instead of trusting: load a DNS leak test with the VPN connected and confirm the resolver shown belongs to your provider, not your ISP. If your ISP's name still appears, the setting isn't working.

IPv6, the other escape route

Many providers tunnel IPv4 only. If your network also hands out IPv6 addresses — increasingly common on mobile and home connections — some traffic can leave over IPv6 with no encryption at all. You have two options: pick a provider that handles IPv6 properly, or disable IPv6 on the device while the VPN is running. The second is the blunter fix, but it works.

Free VPNs and what you actually pay with

Servers, bandwidth and support cost real money every month. An app that charges nothing has to cover those costs somehow, and the honest answer is usually one of a few patterns: selling or sharing browsing data with third parties, injecting ads into pages, bundling code you would never install deliberately, or running a handful of overloaded servers while logging aggressively because that data is the product.

That doesn't mean every free option is malicious. Some reputable paid providers offer genuinely limited free tiers — one location, a data cap — and that can be enough for occasional use on public Wi-Fi. What matters is the company behind the app.

Warning signs in an app listing

• No named company, or a developer name that changes between updates.
• No privacy policy, or one that permits sharing data with “partners” and “affiliates.”
• Permissions unrelated to networking — contacts, SMS, accessibility services.
• Requests to install a device management profile or root your phone.

The kill switch you never switched on

A kill switch cuts off network access the moment the tunnel fails, so nothing falls back to your normal connection. In a lot of clients it ships disabled, and on some platforms it lives in the operating system rather than the app. That gap is where real leaks happen: the VPN reconnects, the browser has already retried, and a request goes out over your home connection.

On Android, look for Always-on VPN together with Block connections without VPN. On Windows and macOS, check whether your client includes a firewall-based kill switch; if it doesn't, you can build the equivalent with firewall rules that only permit traffic through the VPN adapter.

Then test it properly. Connect, then force the tunnel to drop — quit the app from the tray, kill its process, or move between Wi-Fi and mobile data. Your browser should fail to load anything until you reconnect. If pages open anyway, the kill switch isn't doing its job. Remember what it protects against, too: a kill switch handles drops, not a provider that keeps logs.

Your browser trusts the wrong things

Encryption changes where your traffic appears to come from. It does nothing about what your browser volunteers. Sessions, cookies and logins identify you regardless of which server your packets leave from, and if you're signed into a major account while browsing, changing your IP changes very little about what can be linked to you.

Two settings deserve a look. Browser-level secure DNS, also called DNS-over-HTTPS, can override the resolver your VPN is trying to use — either turn it off or point it at your provider's resolver so the two aren't fighting. WebRTC, the technology behind in-browser calls, can expose IP information in ways a VPN doesn't always cover; a WebRTC leak test will tell you.

Extensions are the third piece. Every one of them can read or alter what you do, and your VPN can't see inside the browser to stop them. Keep a separate browser profile for anything sensitive, log in only when you need to, and remove extensions you don't actively use.

Choosing a provider without the marketing

Comparison pages mostly compare server counts. The questions that matter are duller and more useful:

1. Who owns it, and where is it based? Jurisdiction shapes what a company can be compelled to hand over.
2. What does the logging policy actually say? Look for a clear, specific statement, and independent audits of it where they exist.
3. Which leaks does the client cover? DNS, IPv6, WebRTC and a real kill switch, on the platforms you use.
4. Which protocols does it support? WireGuard and OpenVPN are the baseline; obfuscation helps on networks that block VPN traffic.
5. Can you test before committing? A refund window or limited free tier lets you run leak tests first.
6. How many devices, and does it cover a router? Whole-home coverage often beats five separate installs.

Be wary of deeply discounted “lifetime” subscriptions from unfamiliar companies. Running a network for decades on a one-off payment isn't a business model that survives without cutting something.

Know what a VPN can't do

A VPN hides your traffic from the local network and your ISP. It doesn't hide you from sites you log into, it doesn't stop malware, and it doesn't make you anonymous against a determined observer. If anonymity is the actual goal, that's a different tool with different trade-offs. And where VPN use is restricted, check your local rules before installing anything — this is general guidance, not legal advice, so consult a professional if the stakes are high.

Fix it in ten minutes

1. Connect the VPN and run DNS, IPv6 and WebRTC leak tests. Write down anything that shows your ISP's resolver or your real address.
2. Enable the kill switch and always-on mode, then drop the connection on purpose and confirm traffic stops.
3. Point DNS at your provider's resolver, and disable IPv6 if the client doesn't support it.
4. In the browser, check the secure DNS setting, prune your extensions, and use a separate profile for sensitive logins.
5. Re-read the provider's policy and ownership. Companies change hands, and terms change with them.
6. Repeat the leak checks after app or system updates, since updates sometimes reset protection settings.

None of these steps is difficult, and most take less than a minute. The mistake is assuming the app handled it for you. Test, verify, and revisit the settings every few months — that habit protects you better than any feature list.