What does a kill switch try to prevent?
If a tunnel disconnects, the operating system may return traffic to the normal network route. A kill switch is intended to block that fallback for the traffic within its scope. The UK National Cyber Security Centre distinguishes forced VPN routing from configurations where users can bypass or disconnect the VPN; that design choice matters more than the marketing name.
Split tunneling intentionally sends some traffic outside the tunnel, so a single “VPN connected” indicator cannot describe every packet. Browser-only extensions may have a narrower boundary again.
What should a careful test cover?
Use a test account and avoid exposing sensitive activity while testing.
- Record the setup. Note device, operating system, app version, protocol, gateway, IPv6 setting, split-tunnel rules and network type.
- Establish a baseline. Before connecting, record the public IPv4/IPv6 address and DNS resolvers shown by reputable diagnostic tools.
- Connect and compare. Confirm the exposed public addresses and resolvers change as the provider documents. An unfamiliar resolver is not proof of a leak; identify who operates it.
- Exercise transitions. Test a deliberate disconnect, sleep/wake, Wi-Fi to mobile handover and server change. Check whether out-of-scope traffic behaves differently because of split tunneling.
- Repeat after changes. Retest following app, protocol, operating-system or routing-setting updates.
How should you interpret a result?
A clean check means the tested setup behaved as expected during those runs. It does not certify every platform, server or future version. A surprising result also needs diagnosis: cached browser data, enterprise DNS, secure-DNS settings, IPv6 or an intentional split route can affect what a tool reports.
Document the evidence and contact the provider before publishing a provider-wide leak allegation. The honest claim is narrow and dated.