Does a VPN work on Netflix, and why does the answer keep changing?
Sometimes it does. The honest version of the answer is that it is a state rather than a property: a given provider, on a given server, on a given evening, either gets through or gets an error screen, and nothing about that outcome is stable enough to describe as a feature of the provider.
The reason is that detection is overwhelmingly address-based. Nobody at a streaming service is inspecting your encrypted traffic or fingerprinting your tunnel. They are looking up the address your request arrived from in a list, and refusing it if the list says the address belongs to a datacentre or to known VPN infrastructure. Everything else — the proxy error, the smaller catalogue, the sudden failure of a setup that worked yesterday — follows from that one lookup.
Two consequences follow. Almost nothing you change at your end fixes a blocked address, because the problem is not your device, your app or your protocol. And any article naming a provider that works with a named service is reporting the weather, not the climate: true when written, decaying from that moment.
None of which makes the tool useless. A VPN reliably changes the address a service sees, and for the most common legitimate case — travelling and wanting the catalogue you already pay for — that is often all it needs to do. It does mean streaming access is not something any review can promise in advance.
How do streaming services actually detect a VPN?
Every IP address is allocated to an organisation, and the allocation is public: ranges carry a registered owner, an autonomous system number identifying the network announcing them, and usually a reverse DNS name. A home connection sits in a range registered to a residential internet provider. A VPN server sits in one registered to a hosting company, because a VPN server is a machine in a datacentre by construction. That distinction — residential versus datacentre — is the strongest signal available and needs no clever technology to read.
Services either buy this classification from commercial IP intelligence vendors, who maintain it as a product, or build their own lists from observed behaviour. Either way the outcome is a set of ranges that get a smaller catalogue or a refusal. Datacentre classification alone would be crude, since corporate networks legitimately live there, so it is weighted alongside a second, narrower list: ranges observed to be operated by consumer VPN services.
The behavioural signal that builds that second list is the one people find counter-intuitive. On almost every consumer VPN you share a server address with hundreds of other subscribers simultaneously. From the service’s side, one address is presenting several hundred unrelated accounts, registered in different countries, watching different things at once. No household does that. The shared address that mixes you into a crowd for privacy purposes is the same shared address that identifies the crowd as commercial VPN infrastructure.
A dedicated IP inverts that trade: it is yours alone, so the account-density signal disappears. NordVPN, PureVPN and FastestVPN all sell one as a paid add-on, and Proton VPN does not offer it on consumer plans at all — its static addresses are business products. Be clear about what it buys, though. A dedicated datacentre address is still a datacentre address, and one that can be flagged individually. It removes a signal, not the category.
Address is not the only input, just the dominant one. The signals below are cheap to check and are used to catch the case where the address says one country and everything else says another.
- DNS resolver country — if your lookups resolve outside the tunnel through your own provider’s resolver, the mismatch is visible
- Account region — the country the account was registered in, held server-side and unaffected by anything on your device
- Payment country — the card issuer and billing address attached to the subscription
- Device timezone, locale and language headers, sent with ordinary requests
- GPS on mobile, which apps with location permission read directly and which the tunnel does not touch
Why does the cycle run in weeks, and why is every “works with Netflix” list wrong?
A VPN provider that finds its ranges blocked acquires or announces fresh ones. Those addresses start clean, because no list has seen them behaving like VPN infrastructure yet. Traffic moves onto them, the density pattern reappears, the classification vendors and the services catch up, and the ranges get added. Then it happens again. The period between rotation and re-cataloguing is measured in weeks, occasionally days for a heavily used range, and that period is the entire lifespan of any claim about a named service.
Neither side can end it. A service that blanket-refused every datacentre range would lock out corporate networks, some mobile carrier infrastructure and a share of ordinary subscribers, and false positives cost it paying customers directly. A provider that refused to rotate would simply stay blocked. The equilibrium is a permanent, low-grade exchange in which each side does enough and neither side wins.
The commercial reason it settles there explains the pattern better than any story about technical escalation. Streaming platforms license content territory by territory, and those agreements oblige the licensee to take reasonable measures against out-of-region access. Reasonable measures is a contractual standard, not an engineering goal, so enforcement has to be demonstrable and continuous rather than total — which is exactly what this looks like from outside: periods of tightening, periods of drift, no endgame.
This is why the genre of article listing working providers is structurally unreliable rather than merely lazy. The test behind such a list is one subscriber, one server, one country, one day, and it generalises to nothing — the next server in the same city may sit on a range with a different history. Updating monthly does not repair it, because the claim’s half-life is shorter than the update interval, and the date at the top of those pages changes far more often than the recommendation underneath it.
Our shortlist for streaming therefore ranks on whether native TV applications exist, and says so on the page rather than burying the caveat. It is a structural proxy, and the fact that it is a proxy is the point: it is the part of the question that does not change every three weeks.
How do you use a VPN on Prime Video or Disney+ without wasting an evening?
Everything genuinely under your control is at the device and configuration layer. None of it defeats an address that has been catalogued, but all of it removes the failures that get mistaken for a block, and it is worth doing in this order.
Start with the device, because that is where most of the wasted evenings happen. Streaming is mostly watched on a television, and a television either runs a VPN client or it does not. NordVPN scores 10 out of 10 on our platforms criterion for native applications across desktop, mobile, Apple TV, Android TV and routers; Proton VPN scores 9 with the same television coverage. PureVPN and FastestVPN both score 7 and neither ships an Apple TV application, so covering a tvOS device with either one means running the VPN on the router — which tunnels every device in the house through one connection and caps the whole network at whatever the router can encrypt, typically a fraction of the line speed you are paying for. That is a poor trade for a 4K stream.
All four providers allow 10 simultaneous connections, so the limit people actually hit is application availability rather than the device cap. Check the app exists for the specific box you watch on before subscribing, not after.
Then the server. Picking a country from a list is not the same as reaching hardware in it: Proton VPN states 148 countries across 191 locations and says openly that industry counts include virtual locations — addresses registered to one country, running on hardware somewhere else. That still reports the country you chose, so it passes the region check and costs you latency, and latency is what decides whether a high-bitrate stream settles or spends ten minutes stepping through resolutions.
Then DNS. If lookups leave the tunnel to your own provider’s resolver, the service sees a request from one country resolved by a network in another — a mismatch worth removing whether or not it triggers a block by itself. A leak test while connected settles it in a minute.
Finally, the app itself. Streaming clients cache the region they last saw, so a full restart after connecting beats reloading, and on mobile clearing the app’s stored data sometimes resolves a client convinced it lives elsewhere. Do not fix a slow stream by excluding the streaming app through split tunnelling — that sends it out on your real address, which is the opposite of the point, and the feature is uneven anyway. Proton VPN’s split tunnelling is absent on iOS and experimental on macOS; PureVPN’s runs on Windows, Android, Android TV and Fire TV only.
Avoid
- Buying a subscription on the strength of a review claiming a named service works — the claim was perishable when it was published
- Reinstalling the client or switching protocol to fix an address-based block; the tunnel is working, the address is on a list
- Excluding the streaming app from the tunnel to recover speed, which removes the only thing the VPN was doing for it
- Routing the whole household through the router when the device you actually watch on has a native application
- Assuming a country in the server list means hardware in that country — virtual locations are widespread and disclosed
How do you change your Netflix region without a VPN?
For the most part, you do not, and the pages promising otherwise are describing something narrower than they imply. The country attached to a streaming account is set at registration, stored on the service’s side, and tied to the billing method. It is not read from your connection each time you sign in, which is precisely why changing your apparent location does not change your account.
Moving it means moving the billing relationship — a payment method and an address in the new country — and that is an account-level change with account-level consequences, not a settings toggle. The account-risk side of shifting a billing country to reach different regional pricing is covered separately in our guide to VPNs and regional pricing, and the short version is that it is the account, not the connection, that carries the exposure.
What travel does is different again and often confused with region switching. Services handle a subscriber abroad in their own ways, from serving the local catalogue to offering a limited travel selection to restricting some titles entirely. Recovering the catalogue you already pay for while you are away is the least contentious use of a VPN there is: it presents you where you actually subscribe from rather than somewhere you do not.
The alternatives offered under the heading “without a VPN” fall into three groups, and only one is a different mechanism. Browser extensions and free web proxies are the same address-based approach with worse addresses: free proxy pools sit in the same datacentre ranges and are catalogued faster. Changing an app store or device region changes which application you can download, not what your account is entitled to. Smart DNS is the genuine mechanical alternative.
Is Smart DNS a different mechanism, or the same trick renamed?
It is genuinely different, and the difference is the reason it exists. A VPN moves all of your traffic through a server; Smart DNS moves almost none of it. It answers the specific hostname lookups a service uses to work out where you are with the operator’s own endpoint, so the region-check conversation goes through their infrastructure while the video itself travels directly from the service to you.
That buys two things a VPN cannot. No encryption overhead and no detour, so a 4K stream runs at whatever your line does. And it works on hardware with no VPN client at all — an older television, a console, anything where the DNS server is the only network setting you can reach.
It also costs two things people are routinely not told. It provides no privacy whatsoever: your traffic is not encrypted, your address does not change, and your internet provider sees exactly what it saw before. And the region-check traffic that is proxied goes through the operator in the clear, so it is a different party seeing a narrower slice, not nobody seeing anything.
This site got that mechanism wrong once and logged it. Our glossary previously stated that Smart DNS “reroutes nothing”, which was corrected on 14 August 2026 along with fourteen other technical errors found in a review of the glossary. It reroutes precisely the region-check traffic, in the clear, and that is the entire mechanism rather than a footnote to it. We record errors like that on the corrections page because mechanism claims are exactly the ones this category gets published wrong.
What it does not escape is the arms race. The operator’s endpoints have addresses too and get catalogued the same way, and applications increasingly use their own resolvers or encrypted DNS, ignoring the device setting entirely. A different mechanism, the same cycle.
What have we not measured, and what will we not claim?
We have not run a streaming test. Not one, on any provider, on any service. The lab record for all four providers on this site is empty — no speed figures, no leak result — and every review page renders that as “not yet measured” rather than filling the gap with an estimate. There is no hidden testing behind the shortlist ordering.
That is a position rather than an oversight. A streaming test worth anything would have to be continuous, run from several client locations across many servers, and republished with each date attached, because a single result describes one server on one evening. Nobody publishes that, ourselves included, and a one-off test dressed as a standing verdict is worse than silence.
Where independent evidence does exist, we use it and disclose what is wrong with it. The AV-TEST malicious-URL figures we quote — NordVPN blocking 83.42% of 3,209 samples, Proton VPN 4.43% — are carried with the note that the study was commissioned by NordSec, NordVPN’s own parent company, because a reader deserves to weigh that. No equivalent independent, dated, repeated measurement of streaming access exists anywhere in this market. That absence is why our streaming shortlist ranks the structural thing instead.
And the plain negatives, which follow from the mechanism rather than from any provider’s shortcomings. A VPN does not give you a catalogue you have not paid for: the account is the entitlement, the address is not. It does not exempt you from terms of service, which generally prohibit circumventing territorial restrictions — contractual rather than criminal, but real. It costs throughput, most visibly at the highest bitrates. It does not move your account’s country, its payment country, or a phone’s GPS. And it cannot make a catalogued address clean again. That last one is the whole page in a sentence.