Why this feature gets oversold
A VPN kill switch is one of the most marketed features in privacy software, often described as a safety net that makes exposure impossible. The reality is narrower and more mechanical. Understanding what the feature actually does — and where it stops — helps you use it correctly instead of assuming it covers problems it was never built to solve.
What a kill switch actually does
At its core, a kill switch is a network rule. It watches your VPN connection, and if that connection drops unexpectedly, it blocks your device’s internet access until the tunnel reconnects. This is utility networking in its plainest form: a conditional switch, not an intelligent guardian. Its job is narrow — prevent your traffic from quietly falling back to your regular, unprotected connection without your knowledge.
This matters because VPN tunnels do drop. Wi-Fi hiccups, server-side maintenance, and mobile network handoffs can all interrupt a connection for a second or two. Without a kill switch, your device may silently resume sending traffic over the open network during that gap, and you might never notice. With one, that gap results in a pause, not a silent leak.
DNS leaks: a separate problem entirely
A DNS leak is different from a dropped tunnel, and conflating the two is a common source of confusion. DNS leaks happen when your device sends domain lookup requests outside the encrypted tunnel — often to your default internet provider’s resolver — even while the VPN connection itself is active and stable. The tunnel can be working perfectly and a leak can still occur, because DNS requests use their own routing path unless the VPN client is specifically configured to capture them.
This is why reputable VPN apps include DNS leak protection as a distinct setting, not as an automatic side effect of connecting. It forces DNS queries through the VPN’s own resolvers. If an app doesn’t mention this feature at all, assume it is not handled, and verify independently rather than guessing.
What these features do not do
Neither a kill switch nor DNS leak protection makes you anonymous, hides your activity from the VPN provider itself, or compensates for weak app permissions, browser fingerprinting, or account logins that already identify you. These are connection-layer safeguards, not identity tools. They also don’t protect you if you manually disable the VPN, if the app crashes outright rather than disconnecting cleanly, or if the operating system routes certain background traffic outside the VPN interface by design — something that happens on some mobile platforms more than people expect.
Being clear about these honest limits isn’t a knock against the technology. It’s what lets you use it appropriately: as one layer among several, verified periodically, rather than a feature you set once and never think about again.
A simple way to sanity-check your setup
- Confirm the kill switch setting is actually turned on — many apps ship with it off by default.
- Look for a dedicated DNS leak protection toggle, separate from the general connect/disconnect switch.
- Test periodically using any independent DNS leak checker while connected, and again after forcing a brief disconnect.
- Re-check settings after major app updates, since defaults sometimes reset.
Where Spindex Protect fits
Spindex Protect is not a merchant and does not run checks on your device. It operates as a thin pre-lander: a short bridge page that points toward vetted third-party VPN and security offers so you can compare features like kill switch behavior and DNS leak handling before deciding anything. Nothing is scanned, flagged, or installed from this side — the actual software and purchase happen on the partner’s own site.
Disclosure: Spindex may earn a commission if you buy through our partner links. We recommend privacy/security tools as an independent affiliate — this page is not the merchant. Nothing installs from Spindex or the pre-lander.
Disclosure: Spindex può ricevere una commissione se acquisti tramite link partner. Consigliamo strumenti di privacy/sicurezza come affiliato indipendente — questa pagina non è il merchant. Nulla viene installato da Spindex o dal pre-lander.