Beyond the basic "encrypt my traffic" premise, most VPN apps' settings menus have a handful of specific toggles that actually matter a lot in practice: split tunneling, a kill switch, and DNS leak protection. Each one addresses a distinct, real failure mode — worth understanding rather than just leaving on the defaults and hoping.
Split tunneling: choosing what goes through the tunnel
By default, a VPN routes all of a device's traffic through its encrypted tunnel — every app, every connection. Split tunneling lets you carve out exceptions: specific apps or destinations that bypass the VPN and use your normal, direct connection instead, while everything else still goes through the tunnel.
This is useful for a few concrete reasons. Some apps behave badly over a VPN — banking apps and some streaming services actively detect and block VPN connections, so excluding them lets those specific apps work normally without turning the VPN off entirely. Local-network devices (printers, smart-home gear, a NAS on your home network) often become unreachable while a VPN is active, since the tunnel replaces your normal routing; split tunneling can exclude that traffic so local devices stay reachable. And bandwidth-heavy but non-sensitive traffic — a large download, for instance — can be routed directly for speed while everything else stays protected.
The tradeoff is straightforward: whatever you exclude from the tunnel gets none of the VPN's protection — no IP masking, no encryption from your ISP's view, nothing. Split tunneling is a precision tool for specific compatibility or performance problems, not something to reach for by default.
Kill switches: what happens when the tunnel drops
Every VPN connection can drop — a Wi-Fi hiccup, switching networks, the VPN server itself having a brief issue. Without a kill switch, when that happens, most operating systems will silently fall back to your normal, unencrypted internet connection so you don't lose connectivity — which means any traffic sent during that gap, and until you notice and reconnect, goes out unprotected and with your real IP address visible.
A kill switch is a network-level rule that does the opposite: if the VPN tunnel drops, it blocks all internet traffic entirely until the tunnel is reestablished, rather than letting anything fall back to the unprotected connection. It trades a worse failure mode (silent, unnoticed exposure) for a more obvious one (temporarily no internet at all) — which is almost always the better tradeoff if the reason you're using a VPN is to consistently avoid exposing your real traffic or IP address.
Not every kill switch implementation is equally solid — some only block traffic at the application layer rather than at the actual network/firewall level, which can be bypassed by traffic that doesn't go through the app being monitored. A kill switch enforced at the OS firewall level (blocking all traffic system-wide, not just within one app's awareness) is meaningfully more reliable.
DNS leaks: the request that quietly skips the tunnel
Before your device connects to almost any website, it first has to resolve that site's domain name into an IP address — a DNS lookup. Normally, a VPN routes DNS lookups through its own encrypted tunnel and its own DNS resolver, the same way it routes everything else, so a DNS lookup for a site you're about to visit doesn't reveal that destination to your ISP or the network you're on.
A DNS leak happens when those lookups bypass the tunnel and go directly to your normal (often ISP-provided) DNS resolver instead — usually due to an operating system configuration quirk, a misconfigured VPN client, or IPv6 traffic that the VPN doesn't handle even though IPv4 is properly tunneled. The practical effect is that even though your actual browsing traffic is encrypted and routed through the VPN correctly, your ISP (or anyone positioned to see that DNS traffic) can still see the list of domains you're looking up — which is often nearly as revealing as seeing the traffic itself, since domain names alone tell most of the story of where you've been.
This is exactly the kind of failure that's invisible unless you check for it — everything looks normal, your VPN shows "connected," and your actual page content loads through the tunnel fine. The only way to know for sure is to test: with the VPN connected, visit a DNS leak test tool and confirm the DNS servers shown belong to your VPN provider, not your ISP.
How these three interact
These aren't fully independent settings — they overlap in practice. Split tunneling and a kill switch can pull in opposite directions: if you've excluded an app from the tunnel and the VPN connection drops, a kill switch that blocks all traffic system-wide will also cut off that excluded app, even though it was never meant to depend on the VPN in the first place — which is expected behavior, but worth knowing before it surprises you mid-download. Similarly, DNS leaks become more likely, not less, when split tunneling is involved, since routing some traffic outside the tunnel makes it easier for a misconfiguration to also route DNS lookups outside it by accident. None of this is a reason to avoid these features — they solve real, distinct problems — but it's a reason to test your actual configuration rather than assuming three independent settings compose cleanly by default.
Why all three deserve actual attention
Encryption and tunneling get most of the marketing attention, but these three settings are where a VPN's real-world protection quietly succeeds or fails. A misconfigured split-tunnel rule can expose sensitive traffic you thought was protected. A weak or missing kill switch can leak your real IP the moment a connection blips, with no warning. And a DNS leak can undercut the entire point of the tunnel while every visible indicator says everything is fine. None of these are exotic edge cases — they're the specific, checkable things worth verifying in any VPN app you actually rely on.