Kill Switch and DNS Protection Are Different

A VPN Kill Switch and DNS protection are related privacy controls, but they solve different problems. One governs what should happen when the protected route fails. The other influences how domain names are resolved.

What a Kill Switch does

A strict Kill Switch aims to prevent traffic from falling back to the ordinary connection after the VPN route drops. Some browser extensions can only control browser proxy traffic, while an operating-system VPN can enforce broader device rules. Always check the platform and the selected failure policy.

What browser DNS protection does

Disabling browser DNS prefetch can reduce background DNS lookups initiated before a user opens a link. It does not automatically become a system-wide DNS firewall and does not control every operating-system service or application.

How to check them

Use Kill Switch status to read the installed extension's configured fail policy. A real traffic-drop test should be done manually and carefully with a non-sensitive page; this website will not disconnect your tunnel for you. Use DNS Leak Protection to inspect the browser DNS-prefetch policy, then use the DNS Leak Test when authoritative observation is configured.

Do not confuse configuration with proof

A Kill Switch toggle shown as enabled is evidence of configuration, not evidence that all traffic was blocked during an outage. A disabled DNS-prefetch policy is evidence of a browser setting, not proof that every DNS packet from the device remained inside the VPN.