Streaming platforms block VPNs by classifying the exit address ASN as datacentre space, cross-checking your DNS resolver and device location against the claimed country, and sharing blocklists. An exit stops working when its range gets classified, not when your device changes.
The five detection layers
Detection is not one check. Platforms run several independent tests and act when enough of them disagree with each other, which is why the same VPN can work on a laptop and fail on a smart TV on the same network.
Layer one is ASN classification. The exit address is looked up against the global routing table and categorised as residential, mobile, business, or hosting. Addresses originating from AS16509 (Amazon), AS14061 (DigitalOcean), AS20473 (Constant, operating Vultr), AS24940 (Hetzner) or AS16276 (OVH) are hosting space by definition, and no consumer watches television from a rack in a datacentre. This layer alone catches most commercial VPN infrastructure.
Layer two is concurrency. A residential address serving four simultaneous streams is a household. The same address serving eight hundred is a VPN exit, regardless of what its ASN says. Platforms track sessions per address over time and threshold on it, which is why a small provider works until it becomes popular.
Layer three is signal correlation. The platform compares the location implied by your IP with the location implied by your DNS resolver, your device timezone, your account's billing country, your app store region, and on mobile, your GPS coordinates if location permission was ever granted. A US exit address paired with a device reporting Central European Time and a resolver in Frankfurt is an obvious mismatch.
Layer four is shared intelligence. Commercial IP-reputation feeds sell VPN and proxy classification as a product, updated continuously, and multiple platforms subscribe to the same feeds. This is why an address stops working across several services within days of each other.
Layer five is behavioural. Rapid geographic switching on one account, a device that appears in three countries in a day, or a login pattern inconsistent with a household triggers review independently of any address analysis.
What the error codes actually mean
Netflix's proxy error, shown as codes in the M7111-5059 family alongside the message that you seem to be using an unblocker or proxy, means the exit address was classified. It does not mean your account is flagged, and it does not mean anything is wrong with your device. Notably, when Netflix detects a proxy it does not black out the service; it serves only content it holds global rights to, which is why your library shrinks to a small set of original productions rather than disappearing.
BBC iPlayer's message about the service only being available in the UK behaves the same way, as do the geographic notices from Hulu, Max, Disney+ and Prime Video. Sports services enforce most aggressively because their rights contracts carry the largest penalties for territorial breach.
A separate class of failure looks like detection but is not. Buffering that resolves at a lower bitrate, sudden playback stops, and DRM errors referencing licence acquisition usually indicate MTU problems, UDP throttling, or a DRM module that cannot reach its licence server through the tunnel. If the catalogue is intact and only playback fails, the problem is transport, not geo-detection.
Netflix's proxy detection is applied at the streaming request, not at login. You can browse a full catalogue and only see the restriction when playback starts, which makes it look intermittent when it is not.
Diagnose it in three commands
Before changing providers or servers, establish which layer is failing. The three checks below take under a minute and distinguish an ASN block from a DNS mismatch from an IPv6 leak.
If the exit address belongs to a hosting ASN, the block is layer one and no configuration on your device will change it. If the resolver's egress is in a different country from the exit address, that is a layer three mismatch you can fix. If the IPv6 result differs from the IPv4 result, the platform is seeing your real address directly.
- Hosting ASN in result 1: layer one classification, change exit server or provider type.
- Result 2 in a different country from result 1: DNS mismatch, force the VPN's resolver or a resolver in the exit country.
- Result 3 returning two different addresses: IPv6 leak, disable IPv6 on the adapter or use a VPN that tunnels it.
- All three consistent and still blocked: concurrency or shared blocklist, which only a different exit address resolves.
# 1. what address and ASN does the platform see
curl -s https://ifconfig.co/json | python3 -m json.tool
whois -h whois.cymru.com " -v $(curl -s https://ifconfig.co)"
# 2. does your resolver agree with your exit
dig +short whoami.akamai.net
dig +short TXT o-o.myaddr.l.google.com @ns1.google.com
# 3. is IPv6 bypassing the tunnel
curl -4 -s https://ifconfig.co; echo
curl -6 -s https://ifconfig.co; echoWhat genuinely helps
Switch exit servers systematically rather than randomly. Providers rotate address ranges, and within one provider some ranges are classified and others are not. Work through the servers in your target country, testing playback rather than a test page, and note which ones work; the pattern is usually stable for weeks.
Force DNS through the tunnel. A resolver that answers from a different country than your exit address is a free signal to the platform. On desktop, pin the VPN's own resolver on every adapter. On a router-level VPN, make sure the router hands out the tunnel's resolver by DHCP rather than the ISP's.
Eliminate the IPv6 path. If your VPN is IPv4-only and your ISP is dual stack, the streaming app may connect over IPv6 entirely outside the tunnel. Disable IPv6 on the adapter or choose a provider that carries it.
Use a device you can actually configure. Smart TVs and streaming sticks frequently hardcode a DNS resolver, ignore router DNS settings, and some cannot be VPN'd at all. Casting from a configured laptop or phone, or running the VPN on the router with the TV behind it, avoids the class of problem entirely.
Consider connection type. Residential and mobile exit addresses are not classified as hosting, which removes layer one. That is why services offering static residential addresses behave differently from shared datacentre exits. Understand the trade-offs before choosing: such services vary widely in how their address inventory is sourced.
Clear the streaming app's data, not just the browser cache. Mobile apps cache a region assignment and a device identifier that survives cache clearing. On Android, use App info, Storage, Clear storage; on iOS, delete and reinstall.
What does not help, and why
Clearing cookies alone does nothing when the block is at the IP layer, because the decision is made from the connection before any cookie is read. It is worth doing once, after changing exit servers, to clear a cached region assignment, but it is not a fix on its own.
Changing only your DNS to a resolver in the target country does not relocate you. The platform sees your exit address regardless of which resolver answered your lookup. So-called smart DNS services work differently, by intercepting and rewriting specific geo-check requests, and they leave your real IP visible, which some platforms now also detect.
Browser extensions marketed as VPNs are proxies for browser traffic only. They do not affect the streaming app on the same device, and they frequently leak through WebRTC.
Buying more bandwidth, restarting the router, or reinstalling the app addresses none of the five layers. If a diagnostic shows a hosting ASN, the answer is a different exit address; nothing else is relevant.
The legal and account-risk reality
Using a VPN is lawful in the United States and in most jurisdictions. Using one to access content outside your licensed territory is a breach of the platform's terms of service, which is a contract matter rather than a criminal one. Every major platform reserves the right to terminate accounts for it.
In practice, enforcement against consumers has been overwhelmingly technical rather than punitive: platforms block the address and restrict the catalogue rather than closing accounts. That is a business decision, not a guarantee, and it applies unevenly. Sports rights holders in particular have pursued more aggressive enforcement.
There is also a legitimate use case that this article is mostly about: travellers and expatriates trying to reach the service they pay for at home, from abroad. That is the scenario where a VPN failing is a genuine problem rather than an arbitrage attempt, and it is the case platforms handle worst because their detection cannot distinguish it from anything else.
Frequently asked
Why did my VPN work with Netflix last month and not now?
The exit address range was reclassified. Detection feeds update continuously, and an address pool that was unlisted becomes listed once enough streaming sessions originate from it. Nothing changed on your device. Switching to a different server within the same provider is the first thing to try, and it often works immediately.
Does Netflix ban accounts for VPN use?
In practice it restricts the catalogue rather than terminating accounts, serving only titles it holds worldwide rights to. Its terms permit termination, so the risk is not zero, but consumer account closures for VPN use have been rare. Sports streaming services enforce more aggressively because their rights contracts are stricter.
Will a residential IP always work for streaming?
It removes the ASN classification layer, which is the most common cause of blocks, but not the others. Concurrency thresholds still apply if many users share the address, and DNS or GPS mismatches still trigger review. Residential exits fail less often, not never.
Why does streaming work on my laptop but not my smart TV?
TVs and streaming sticks often ignore router-supplied DNS and use a hardcoded resolver, which creates a location mismatch the platform detects. Many also cannot run VPN software at all, so they connect outside the tunnel. Running the VPN on the router and blocking outbound port 53 to anything but the tunnel resolver usually resolves it.
Does a smart DNS service work better than a VPN for streaming?
It can, because it does not change your IP and therefore avoids ASN classification entirely; it only redirects the geo-check requests. The trade-off is that it provides no encryption or privacy benefit, your real address stays visible, and platforms have added detection for the DNS redirection pattern itself.