Encryption and trust
DNS leak
Lookups leaving outside a VPN tunnel, telling the local network every name you visit.
It happens when the resolver stays on the local network. VPN clients close it by pushing a resolver reachable only through the tunnel. Encrypted DNS (DoH, DoT) protects lookups even without a VPN.