My VPN Was Leaking My Real Location for Months — Here's Every Setting I Turned On After Finding Out
I ran a DNS leak test on a whim after reading a comment thread about VPN misconfigurations, fully expecting it to come back clean. It didn't — my ISP's DNS server was visible the whole time, meaning my browsing history had been tied back to my actual location the entire time I thought I was protected. I'd been using the same default settings since installing the app two years earlier. Here's every setting I actually went through and changed afterward, and why each one matters.
Kill Switch: The One I Assumed Was Already On
This was the first thing I checked, and it wasn't enabled — I'd assumed a kill switch was default behavior on any reputable VPN, and it wasn't on mine. A kill switch cuts your entire internet connection the moment your VPN drops, rather than silently falling back to your unprotected connection. Without it, a brief VPN disconnect (which happens more than you'd think, especially switching between Wi-Fi and cellular) exposes your real IP and traffic for however long it takes you to notice. It's usually sitting in General or Advanced settings, often labeled exactly "Kill Switch," sometimes "Network Lock." Takes one toggle, and there's genuinely no reason to leave it off.
Custom DNS: What Was Actually Leaking
This was the specific setting behind my leak. By default, DNS requests (the lookups that translate a website name into an address) were routing through my ISP even while the VPN was connected, because the app wasn't forcing DNS traffic through the encrypted tunnel properly. I switched to Cloudflare's DNS (1.1.1.1) manually in the VPN's advanced settings, then re-ran the leak test — clean the second time. Google's DNS (8.8.8.8) is another reasonable option if you'd rather use that. This is buried deeper in settings menus than it should be, which is probably why so many people never touch it.
Protocol Choice: I'd Never Once Looked at This
My VPN had been sitting on "Automatic" the entire two years, which picks a protocol without telling you which one or why. I switched to WireGuard specifically, since it's newer, noticeably faster in my testing, and uses modern cryptography without the overhead of older protocols. OpenVPN is the more battle-tested, extensively audited alternative if raw speed matters less to you than a longer security track record. IKEv2/IPSec is worth knowing about specifically if you're switching networks often (like moving between home Wi-Fi and mobile data throughout the day) since it reconnects faster than the other two in that scenario. I noticed a real, measurable speed improvement just from manually picking WireGuard instead of leaving it on auto.
Obfuscation: Only Needed It Once, Glad I Knew Where It Was
Obfuscation (sometimes labeled "stealth mode") disguises your VPN traffic to look like regular browsing, which matters specifically when a network is actively trying to detect and block VPN connections — restrictive countries, some corporate networks, occasionally aggressive public Wi-Fi. I didn't need this for daily use, but I found and tested it before a trip specifically so I wasn't fumbling through settings menus at a border crossing or hotel front desk. Worth locating in advance even if you rarely use it, rather than discovering you need it in a moment when you actually can't afford the delay.
🔒 Want a VPN That Gets These Settings Right by Default?
Skip the digging through menus — this option covers the essentials out of the box.
👉 Check Out the OfferSplit Tunneling: Not a Security Setting, But Worth Knowing
This one doesn't add security exactly, but it fixed a real annoyance — I route my browser through the VPN and exclude my banking app, since it used to log me out constantly from the server-location jumps. Found under "Split Tunneling" or "App Exclusions" in most VPN apps. Not every provider offers this on iOS specifically, since Apple's VPN framework limits how deep third-party apps can control this compared to Android — worth checking your specific app before assuming it's there.
Testing It Yourself
Whatever settings you end up changing, actually test afterward rather than assuming they worked. I use dnsleaktest.com and ipleak.net, both free and quick — connect your VPN, run the test, and confirm the location and DNS server shown match your VPN's server, not your real ISP. I now check this every few months rather than assuming a setting I turned on once is still behaving correctly after an app update.
Quick FAQ
Is a kill switch really necessary, or is it overkill?
Necessary, in my opinion — it's a low-effort toggle protecting against a real, common failure mode (brief disconnects), not a rare edge case.
Which protocol should I actually pick?
WireGuard for most day-to-day use if speed matters to you. OpenVPN if you want the longer-audited option. IKEv2/IPSec specifically if you're frequently switching networks throughout the day.
How do I know if my VPN is leaking right now?
Run a free DNS leak test while connected. If it shows your ISP's DNS server or your real location instead of your VPN's, something's misconfigured — don't assume it's fine just because the app shows "Connected."
Conclusion
Two years of assuming I was protected, undone by settings that took maybe fifteen minutes total to actually find and fix once I went looking. If you've never run a DNS leak test on your own setup, that's genuinely the first thing worth doing before anything else on this list.
More honest VPN and security breakdowns like this are up on Tech & Rewards.