DNS and VPN Choice Can Skew Internet Location Studies

DNS and VPN choice can materially change Internet location measurements, even when researchers connect from the same economy and, where possible, the same city. Researchers reporting through the APNIC Blog found that different Virtual Private Network (VPN) providers led browsers to contact different server addresses and physical locations. That can alter conclusions about whether web traffic remains domestic, crosses borders or depends on infrastructure in another economy.

The researchers built VPN-Scope, a system that visited the same websites through four providers: ExpressVPN, NordVPN, ProtonVPN and Surfshark. The study covered 14 economies in Europe and the Americas. For each economy, it selected 1,000 sites drawn from global rankings, locally popular services and government websites. Each site was scheduled for 25 visits through each provider over three weeks in March and April 2025.

During every visit, VPN-Scope recorded all servers contacted while the page loaded, not only the main website. This included servers supplying scripts, fonts and other embedded resources. The team examined the addresses' geographic locations and hosting organizations, then ran additional Domain Name System (DNS) experiments. DNS is the system that translates a website name into the numerical address used to reach its server. Targeted tests also investigated the physical locations that actually delivered content.

Chile produced the clearest example. Through ExpressVPN, 9.5% of analysed requests were associated with addresses geolocated to Chile. The domestic share rose to 62.7% through Surfshark and 64.2% through NordVPN. Brazil accounted for 57.1% of requests through ExpressVPN, but only 2.8% through Surfshark and 2.4% through NordVPN. The United States represented 24.4%, 25.5% and 25.1%, respectively. The measurements covered the same website set and source economy, yet one provider made Chile appear heavily dependent on Brazilian infrastructure while two others produced a mostly domestic picture.

Results from the United States and United Kingdom also varied, although less dramatically. For measurements originating in the US, addresses geolocated there accounted for between 86.0% and 90.6% of requests across the four providers. The Netherlands ranged from 1.2% to 4.1%, while Canada ranged from 0.3% to 2.4%. From the UK, the domestic share ranged from 52.6% to 63.8%. Dutch destinations ranged from 5.0% to 12.2%, French destinations from 0.8% to 5.1%, and Belgian destinations from 2.7% to 5.1%. Russia, Germany, Ireland, China and Japan also appeared among the ten most common destinations in both sets of measurements.

The DNS tests helped explain part of this variation. When the researchers compared two providers in the same economy, the sets of addresses returned by DNS differed in approximately 12% of comparisons for initial website domains, meaning the main names entered into a browser. For dependency domains, which provide components such as scripts, fonts and analytics, disagreement rose to approximately 31%. Measuring only the main website address can therefore conceal a significant part of the provider-dependent difference.

Different addresses usually did not mean entirely different hosting companies. Compared DNS answers shared at least one hosting organization in 98% of initial-domain comparisons and 96% of dependency-domain comparisons. Those figures indicate some overlap, not necessarily identical lists of companies. The findings therefore suggest that VPN choice changes the measured location of content more strongly than it changes the measured identity of the organizations hosting that content.

Several sources of variation can be reduced through better experimental controls. Researchers can independently confirm the VPN exit location, compare connections from the same city, keep browser settings and timing consistent, and record the provider, connection settings and network used. Describing a measurement only as coming from Italy, for example, leaves out information that could materially affect the result. Researchers must also check which DNS service answers the website-name lookups, because selecting the same service in every setup does not guarantee that each VPN will actually use it.

Other differences come from network decisions that browser settings cannot standardize. A Content Delivery Network (CDN) stores copies of content in multiple places and chooses which one should answer a request. That choice can depend on the network from which the request arrives. Internet routing can also send two connections to different physical facilities even when both use the same destination address. In targeted tests beginning in Milan, VPN connections reached content-serving locations in either Milan or Frankfurt. A common starting city, and even a common destination address, did not ensure a common physical destination.

These results matter most when research concerns cross-border data flows, data localization or the geographic distribution of Internet infrastructure. Server-location measurements do not, by themselves, establish where data is ultimately stored. They show which endpoints and physical replicas served the observed requests. Conclusions about the economy containing an endpoint, whether traffic appears domestic and which physical copy supplies content were more sensitive to VPN choice; conclusions about the hosting organizations involved were generally more stable.

A result collected through one VPN should consequently be presented as one view of the network, not as a provider-independent picture of an entire economy. Repeating important measurements through multiple providers cannot remove every effect of DNS infrastructure, CDN selection and routing, but it can expose conclusions that depend on the chosen tool. For readers reviewing or reproducing such work, a service such as AEU DNS provides private, secure DNS, although researchers must still verify whether their VPN configuration actually uses the selected DNS service.