Opera Browser VPN vs System DNS: Does the VPN Enforce DNS Routing?

Answer the Question First

When the Opera Browser’s built‑in VPN is active *and* the Use system DNS toggle is turned off, the VPN normally forces every DNS query through its own DNS servers. In practice, the VPN creates a virtual network interface (TAP) that captures all outbound traffic, including DNS on ports 53. However, on some operating systems and network configurations that interface can be bypassed, leading to intermittent DNS leaks.

Underlying Mechanism

Opera’s VPN installs a system‑level VPN service that attaches a TAP interface to the host. All traffic that the OS routes through this interface is encapsulated and sent to the VPN server. When Use system DNS is disabled, Opera registers a DNS proxy on the TAP interface and instructs the system resolver to use it. If the resolver is correctly bound to the TAP interface, every DNS request is tunneled.

Platform‑Specific Nuances

• Windows 10/11: The TAP interface is normally the primary route for all traffic. If another adapter (e.g., Wi‑Fi) has a lower metric or a DHCP‑assigned DNS server, some IPv6 or UDP/TCP 53 queries may escape the VPN.
• macOS & iOS: The system resolver respects the Use system DNS setting. If a user has a custom DNS configuration profile or a third‑party resolver, the resolver may still send queries directly to those servers.
• Android (API 28+) and Linux: These platforms use the OS VPN API. Split‑tunneling or apps that enforce private DNS (DoT/DoH) can bypass the VPN interface, especially if the VPN is configured only for IPv4 traffic.

When Leaks Can Still Occur

• IPv6 traffic that is not routed through the TAP interface.
• Applications that use DNS‑over‑HTTPS (DoH) or DNS‑over‑TLS (DoT) on port 443, which bypass the OS resolver.
• Custom DNS profiles or static DNS settings that override the VPN’s proxy.
• Split‑tunnel configurations that exclude the VPN for specific address families or applications.

How to Verify on Your System

1. Open Opera, enable the VPN, and turn Use system DNS off.
2. Navigate to a DNS‑leak testing site such as dnsleaktest.com and run the test. All listed resolvers should belong to Opera’s VPN IP range.
3. For a deeper check, capture packets on the physical network interface while the VPN is active:

   # Windows (Wireshark GUI) – filter: udp.port==53 || tcp.port==53
   # macOS/Linux – tshark -i en0 -f "udp port 53 or tcp port 53"
   # Android – use the built‑in packet capture in the VPN settings
   

   Ensure no DNS packets appear outside the TAP interface.
4. Repeat the test on each target OS (Windows, macOS, Linux, Android, iOS) if possible, as the routing behavior can differ.

What We Still Need to Know

To give a more precise recommendation for your setup, could you confirm which operating system and version you are using? This will help determine whether platform‑specific quirks might be affecting your DNS routing.