Is Your VPN Actually Working?

Published August 30, 2026 Updated August 31, 2026 11 min read

A changed IP address is the weakest possible evidence that a VPN is doing its job. What to check instead, and the four ways a connected VPN still exposes you.

Most people verify a VPN the same way: connect, check their IP address, see a different city, done.

That confirms one thing — that web traffic to that one site went through the tunnel at that one moment. It says nothing about DNS, nothing about IPv6, nothing about what happens when the tunnel drops, and nothing about whether you are still identifiable by other means.

A VPN can be connected, showing the right country, and still be leaking. Here is what to actually check.

Test your VPN now
Check your public IP, the network it belongs to, and whether your connection is classified as a VPN — before assuming the tunnel is doing its job.
Run the VPN check → · IP lookup → · DNS leak test →

The five checks, in short

Run these together, connected. The detail behind each one is below.

Check	What you want to see
IP lookup	Public IP changed, and the network belongs to the VPN or its exit infrastructure
DNS leak test	No DNS path outside the tunnel you intended to use
IPv6	Either routed through the VPN, or blocked if the VPN does not support it
Kill switch	Traffic stops when the tunnel fails
VPN check	Consistent with the server you selected

Fail any of the first four and something is escaping. The fifth is informational rather than pass/fail — detection is inference, not proof.

What is meant to happen

WITHOUT VPN
  You ──────── ISP ──────────── Website
                │
                └── DNS to ISP resolver

WITH VPN (working)
  You ═══ encrypted tunnel ═══ VPN ─── Website
                                │
                                └── DNS via the tunnel

WITH VPN (leaking)
  Traffic  ═══ tunnel ═══ VPN        ✓
  DNS      ─────────────► ISP        ✗ leak
  IPv6     ─────────────► ISP        ✗ leak

First, what a VPN does and does not do

A great deal of confusion comes from expecting the wrong thing. The help page covers the mechanics; the short version of what changes:

What it hides: your IP address from the sites you visit, and your traffic contents from your ISP and anyone on the local network.

What it does not hide: your identity from services you log into, your browser fingerprint, cookies, or the fact that you are using a VPN. Your VPN provider can also see what your ISP previously could — you have moved the trust, not removed it.

So "is my VPN working?" needs to mean something specific. The useful version is: is all my traffic actually going through the tunnel, and does it stay that way?

The four-part check

1. Does your IP change?

The basic test, and worth doing properly rather than casually.

Run the IP lookup disconnected, note the ISP and ASN, then connect and run it again. The public IP should change, and the network it belongs to should normally correspond to the VPN provider or its hosting and exit infrastructure rather than your home ISP.

If the address changes but the organisation still appears to be your home ISP, investigate rather than assume — ownership databases are imperfect and reseller arrangements can produce odd labels, so read the IP, the network, DNS and the route together rather than any one of them alone.

The VPN check adds a second signal: whether the address belongs to a hosting provider rather than a residential ISP. That is how streaming services identify VPN users, and it is why a "working" VPN can still get you blocked.

2. Is DNS going through the tunnel?

The most common real leak, and invisible to an IP check.

Your traffic can be fully encrypted while your DNS lookups go to your ISP's resolver, handing them a timestamped list of every domain you visited. The DNS leak test shows which resolvers answered.

The question to ask: are my DNS queries following the path I intended? If they are going to your ISP's resolver when you expected them to use the VPN's, that is evidence of a leak. Note the resolver does not have to belong to the VPN company — a configuration that deliberately sends DNS to a public resolver through the tunnel is working as intended. What matters is whether the queries stay inside the path you chose. Fixing a leak usually means enabling DNS leak protection in the client or overriding resolvers at the OS level.

3. Is IPv6 escaping?

The leak people most often miss, because most tools historically only checked IPv4.

If your VPN routes IPv4 only and your ISP provides IPv6, then IPv6-capable sites can be reached directly, outside the tunnel, revealing your real address. Many VPN clients simply disable IPv6 rather than tunnel it — crude, but effective.

Check whether you have an IPv6 address at all while connected, and if so whether IPv6 traffic is actually going through the tunnel rather than around it. The question is routing, not ownership. If your VPN does not tunnel IPv6, enable its IPv6 leak protection or block IPv6 option — blocking it is a perfectly valid outcome, and better than leaving it outside the tunnel.

4. What happens when it drops?

VPN connections fail — network changes, laptop wake, server restarts. The question is what your traffic does in that gap.

Without a kill switch, everything falls back to the plain connection instantly and silently. Depending on what you were doing, that can be a more meaningful exposure than a DNS leak, because it is all your traffic rather than metadata.

To test it: connect the VPN, start a continuous ping, then quit the VPN application abruptly rather than disconnecting cleanly.

Windows          ping -t 1.1.1.1
macOS / Linux    ping 1.1.1.1

With a working kill switch, the pings should stop. If traffic continues after the tunnel is abruptly terminated, the kill switch is not preventing fallback to the normal interface. Enable kill switch, network lock, or block connections without VPN — the name varies by client.

Two caveats on this test. Ping only tells you about ICMP, so if the client documents a stronger test, use it — a browser request or a file transfer exercises paths a ping does not. And clients implement this differently: some install firewall rules that persist through a crash, others only act during an orderly shutdown, so test both an abrupt kill and a clean disconnect. Do not run either while something important is in flight.

Things that still identify you

Worth being direct, because VPN marketing tends to imply otherwise.

Logged-in accounts. If you sign into an account, that account knows who you are regardless of your IP.

Browser fingerprinting. Screen size, fonts, timezone, hardware details and extensions combine into a signature that can be highly distinctive — how distinctive depends on your browser and its anti-fingerprinting protections — and it is entirely unaffected by your IP address. A mismatch between a VPN's country and your browser's timezone is itself a signal.

Cookies. Existing cookies survive connecting to a VPN. A private window helps; clearing them helps more.

WebRTC. Browsers can reveal local and sometimes public addresses through WebRTC's connectivity mechanisms, independently of the tunnel. Modern browsers have tightened this, but it remains worth knowing about.

Traffic timing. Not a practical concern for most people, but a VPN does not hide that you are connected or how much data you move, and it does not automatically defeat traffic-analysis techniques that infer patterns from timing and volume.

The honest summary: a VPN changes who can see your traffic and what address sites observe. It is not anonymity, and treating it as such leads to worse decisions than understanding what it actually provides.

Reading an unexpected result

"You appear to be using a VPN" when you are not. Some ISPs allocate from ranges that look like hosting, business connections often do, and mobile carriers sometimes route through infrastructure that classifies oddly. Detection is inference, not fact.

"No VPN detected" while connected. Some providers use addresses that classify as residential rather than hosting. That may be the VPN working as intended for its particular use case — streaming access, for instance — rather than a failure. Classification also simply varies between databases.

Location wrong while connected. You are seeing the exit server's location, which is what should happen. If it is a different country than you chose, check the client.

Everything looks right but a site still blocks you. Usually the address is on a shared blocklist because other people used it. Switching servers normally resolves it.

Before you rely on it

Run the five checks at the top together, in one sitting, with the VPN connected — and re-run them after any client update or network change, since a working configuration can quietly stop working. A tunnel that passed last month is not evidence about today.

Frequently asked questions

How do I know if my VPN is actually working?

Confirm four things, not one: your IP and ISP organisation both change, no DNS resolver belongs to your ISP, IPv6 is either absent or VPN-owned, and traffic stops when the VPN client is killed. A changed IP alone tests only the first.

My IP changed but is my VPN really working?

Not necessarily. A changed IP shows web traffic to that site used the tunnel at that moment. DNS lookups, IPv6 traffic and anything sent during a brief drop can still bypass it entirely.

What is a VPN kill switch and do I need one?

It blocks all traffic if the tunnel fails, instead of silently falling back to your normal connection. Since VPN connections drop routinely — network changes, sleep, server restarts — it is the difference between a brief gap and an unnoticed exposure.

How do I test for a VPN DNS leak?

Connect the VPN and run a DNS leak test. Look at which resolvers answered and who operates them. If queries are going to your ISP's resolver when you expected the VPN's DNS path, that is a leak — and worth checking against the disconnected result so you know what your normal resolvers look like.

How do I test a VPN kill switch?

Connect the VPN, start a continuous request such as ping -t 1.1.1.1, then terminate the VPN client abruptly rather than disconnecting cleanly. Traffic should stop rather than falling back to your normal connection. Test a clean disconnect too, since some clients only engage protection on an orderly shutdown — and do not run either while anything sensitive is in progress.

Can my ISP see anything when I use a VPN?

They can see that you are connected to a VPN, when, and how much data you move. They cannot read the contents. But if DNS is leaking, they still see every domain you look up, which is often the thing people were trying to hide.

Why do websites still know my location with a VPN?

Frequently browser geolocation, timezone, language settings, or an existing logged-in account — none of which depend on your IP address. A VPN changes your network location only.

Does a VPN make me anonymous?

No. It changes which network you appear to come from and encrypts traffic in transit. Accounts, cookies and browser fingerprinting identify you independently, and your VPN provider occupies the position of trust your ISP previously held.

Should I disable IPv6 when using a VPN?

If your VPN does not tunnel IPv6, then yes — otherwise IPv6-capable sites can reach you directly around the tunnel. Many clients offer this as "IPv6 leak protection". A provider that properly tunnels IPv6 does not need it.