Author: theninja

One of the simplest ways to investigate how a VPN actually operates is to examine the DNS answers it provides.  They provide a lot of clues that most people don’t even consider. Indeed,  most users never see these responses. Who looks at how DNS works anyway, if you reach a website then it’s probably worked.  For a VPN user, it’s the same they select a VPN server, open their browser and expect websites to work.

But looking at the addresses which are actually returned for particular websites can reveal some surprisingly sophisticated network behaviour.   We recently ran a series of tests against NordVPN’s UK servers to examine its SmartPlay technology, particularly in relation to BBC iPlayer.   The results closely resemble techniques documented by security researchers several years ago.

A different answer to the same question

DNS normally translates website names into IP addresses.  If a computer wants to visit www.bbc.co.uk, it requests the associated address from a DNS resolver.

Using Google’s public DNS service, our test returned several ordinary BBC addresses, including:

212.58.236.1

These are conventional public addresses that can be used to establish connections to the BBC website.   You should be able to resolve this address from most computers using standard DNS resolvers like Cloudflare, Google or the one allocated you by your ISP.

We then connected to a NordVPN UK server and repeated the lookup, allowing NordVPN to use its own DNS resolver.   This is where everything changed – you’d expect the same result – after all we still want to visit the same website – there’s no different target involved just because we’re going through a VPN.

 

 

This time the result was:

192.0.0.60

That address is significant because it belongs to an IANA special-purpose address range. It isn’t an ordinary publicly routed BBC server address.  Rather than returning the usual destination, NordVPN was supplying an address that could be handled within its own networking infrastructure.

We repeated the test across three different UK VPN servers: UK #3044, #2434 and #6098.

Each had a different public VPN IP address.  All three returned exactly the same DNS result for www.bbc.co.uk.

 

This suggests that NordVPN maintains consistent internal addressing for certain streaming-related destinations, rather than simply relying on whichever public IP address belongs to the connected VPN server.

It doesn’t establish that all three connections use the same physical forwarding server.

What happens after DNS?

A modified DNS response would be of little practical value if the resulting connection failed.

To investigate further, we used curl to establish an HTTPS connection to the BBC website.

The result was straightforward:

Connected IP: 192.0.0.60

HTTP status: 200

The connection succeeded, and the website returned a normal successful HTTP response.   This is consistent with traffic being handled by internal forwarding infrastructure.  There is useful historical evidence for this approach, it’s been investigated before.

In 2023, researchers from the University of Twente published Stranger VPNs: Investigating the Geo-Unblocking Capabilities of Commercial VPN Providers.

Their work documented DNS manipulation and transparent TLS forwarding proxies used by commercial VPN services.    For Netflix, the researchers recorded a NordVPN DNS response of:

192.0.0.69

When we tested Netflix in November 2026, NordVPN returned precisely the same address. An HTTPS connection to that address also succeeded.   This suggests continuity in the broad DNS-based approach, although it doesn’t prove that the underlying servers or network arrangements are unchanged.   Nord VPN is routing conenctions to streaming services differently, it’s going through dedicated hardware which gives them more control over the connection than the previous default behaviour that every normal conenction follows.

Not every BBC connection is treated alike

Another useful finding emerged when we examined different BBC domains.   The main BBC website and the domain emp.bbc.co.uk both resolved to 192.0.0.60.

However, static.bbc.co.uk returned an ordinary public Akamai address.   An unrelated website, Wikipedia, also resolved normally.

This selective behaviour matters, for big websites they’re more than a single website.  Sites like modern streaming platforms definitely aren’t single websites, they are much, much bigger. They depend on multiple domains for authentication, navigation, player components, video delivery and other functions.

A VPN provider can potentially apply specialised handling to particular destinations without changing every connection made by the user’s device.  Kingsmead Security documented similar techniques in its 2022 investigation of proxy-based VPN streaming infrastructure.

What these tests establish — and what they don’t

The evidence demonstrates that NordVPN is still returning special DNS addresses for selected streaming-related domains and that HTTPS connections through those addresses can work.   What we haven’t established is the final public IP address presented to the BBC, or the complete forwarding route inside NordVPN’s network.  That’s difficult to track down, but we intend to try!

Nor does a successful HTTPS request prove that every BBC iPlayer programme will play.   We don’t know for sure how and what is happening at the BBC end or the Netflix connectory, i.e. how the connection is handled or even responded to.   For anyone who wants to see the process rather than just read the results, we’ve recorded a practical explanation using network diagrams, PowerShell tests and a BBC iPlayer playback demonstration.

Watch the video: How NordVPN Works With BBC iPlayer — SmartPlay Explained

What makes SmartPlay worth examining isn’t a dramatic new networking invention. DNS manipulation and forwarding proxies are long established technologies.  There are alternatives to VPNs which use these techniques called Smart DNS.    However this seems different, Smart Play looks like a step forward and has components can be combined within a consumer VPN application, operating largely invisibly while the user simply connects to a server.

The familiar VPN connection interface hides a considerably more complicated routing system which can be changed, tweaked and modified without changing the client.