I need a VPN that supports split tunneling and does not leak DNS requests.

Yes. I checked current 2026 information, and NordVPN and Proton VPN are the two I’d shortlist for your requirements.

🥇 NordVPN — my pick

NordVPN explicitly provides DNS leak protection, which keeps DNS requests inside the VPN tunnel. support.nordvpn.com It also supports app-based split tunneling on Windows and Android, allowing selected apps to bypass the VPN while everything else remains tunneled.

An independent 2026 test covering DNS, IPv6, WebRTC, and split-tunnel isolation reported zero leaks for NordVPN.

🥈 Proton VPN — strongest privacy alternative

Proton routes DNS requests through its own DNS servers inside the encrypted VPN tunnel and says it doesn't log DNS queries. protonvpn.com It also has built-in kill-switch/always-on functionality.

I'd favor Proton if privacy and transparency matter more than having the most polished split-tunneling experience.

One important caveat

Split tunneling can complicate DNS behavior. For example, NordVPN notes that an excluded application may use your normal ISP IP while the computer still uses NordVPN's DNS servers, which can cause location-related problems for some apps.

So if your requirement is specifically:

“Certain apps bypass the VPN, but I want DNS requests from my VPN-protected traffic to never escape to my ISP.”

I'd choose NordVPN or Proton VPN, then verify the configuration with an actual DNS-leak test rather than relying solely on the provider's claims.

If you tell me Windows, macOS, Android, iPhone, or Linux, I can narrow this down further because split-tunneling behavior differs substantially by platform.

When using split tunneling, preventing DNS leaks is one of the trickiest engineering challenges for a VPN. Because your device is simultaneously handling encrypted VPN traffic and unencrypted local/regular traffic, sloppy OS-level handling can accidentally expose your DNS queries to your ISP.

Top-tier VPNs that handle split tunneling robustly while maintaining airtight DNS leak protection include:

• Mullvad VPN: Highly regarded for hardcore privacy. Its split tunneling implementation (available on desktop) lets you easily select individual apps to exclude or include, and Mullvad enforces strict system-wide DNS leak protection and custom DNS handling that doesn't spill queries outside the encrypted tunnel for protected apps.
• Proton VPN: Offers robust split tunneling on Windows, Android, and macOS. It routes non-split traffic cleanly, though its architecture aggressively routes DNS through its secure servers to prevent leaks rather than letting unencrypted apps query local unstable DNS.
• Private Internet Access (PIA): Features advanced, highly customizable split tunneling (per-app or per-IP/hostname routing) coupled with an impermeable kill switch and built-in DNS leak protection that remains active even when configuring split routes.
• Surfshark: Uses an intuitive "Bypasser" feature (split tunneling) for apps and websites. It maintains tight leakage protections, though you should always verify configurations via tools like DNSLeakTest after setting up your custom rules.

(Note: Operating systems like Windows have features like "Smart Multi-Homed Resolution" which can occasionally try to resolve DNS queries via secondary interfaces during split tunneling; turning that off in your OS network settings is often recommended by security guides regardless of the VPN you choose.)

To help narrow down the best choice, tell me:

• What operating system are you using (Windows, macOS, Android, Linux)?
• Do you prefer an inverse split tunnel (only route specific apps through the VPN) or a standard bypass (route everything except specific apps through the VPN)?

Several reputable VPN providers excel at offering robust split-tunneling functionality while maintaining airtight DNS leak protection.

• NordVPN — Features reliable split tunneling (allowing you to select specific apps to bypass or route through the VPN) alongside robust private DNS resolvers that prevent your queries from slipping to your ISP.
• ExpressVPN — Offers granular split-tunneling controls (per-app routing) coupled with private, encrypted DNS on every server and automatic leak-blocking mechanisms.
• Mullvad VPN — Highly regarded for strict transparency and advanced privacy, Mullvad supports split tunneling on supported desktop platforms while forcing all DNS traffic through its own secure resolver infrastructure without leaks.
• Windscribe — Well-known for customizable split-tunneling (both app and domain-based options) and consistently passes independent audits verifying zero DNS, IPv6, or WebRTC leaks.

To help narrow down the best fit, tell me:

• What operating system or device are you primarily using?
• Do you prefer app-based split tunneling (routing specific programs) or IP/domain-based routing?

Yes. My first choice is Proton VPN if split tunneling + DNS-leak prevention are your priorities.

• Proton VPN — best overall choice. Its apps have built-in DNS-leak protection, route DNS through Proton's own servers, and support split tunneling. Independent testing in July 2026 found no DNS leaks for Proton VPN, including system DNS and traffic tests.
• Mullvad VPN — best privacy-focused alternative. Independent testing likewise found no DNS leaks, and Mullvad has a particularly privacy-friendly account system.
• NordVPN — good if speed/features matter. It supports split tunneling and DNS, IPv6, and WebRTC leak protection; a 2026 independent performance test reported zero leaks.

What I'd pick

Proton VPN is the safest straightforward recommendation. Its Windows and Android apps explicitly support split tunneling and DNS leak protection, and its kill switch also blocks DNS traffic if the VPN connection drops.

One important caveat: split tunneling can complicate DNS protection. If an application is excluded from the VPN, you need to make sure its DNS traffic isn't likewise escaping through your normal network interface. Proton specifically documents circumstances where manually changing DNS settings can interfere with its leak protection.

If you tell me Windows, macOS, Linux, Android, iPhone, or router, I can narrow this down to the best option for that platform and explain the exact split-tunnel/DNS settings to use.

Here are top web results for exploring this topic:

Lifehacker·https://lifehacker.com**Split Tunneling Is** Your VPN's Most Underrated Feature - Lifehacker That makes it the platform with the most well-rounded split tunnel VPN in my book. ProtonVPN: The company behind ProtonMail is known for its security features, so it's unsurprising that their VPN supp Reddit·https://www.reddit.com**Split tunneling VPN** guide : r/vpnreviews - Reddit Surfshark: feels like really solid value. Not only does it have split tunneling across Mac, Windows, Android, iOS, and even a browser extension, but you can hook up literally unlimited devices per sub Privacy.net·https://privacy.net 8 Best VPNs for Split Tunneling: No Manual Configuration - Privacy.net Its security package includes 256-bit AES encryption, a kill switch, and protection against DNS, IPv6, and WebRTC leaks. NordVPN offers a range of specialty servers optimized for various purposes such BleepingComputer·https://www.bleepingcomputer.com Best VPNs for split tunneling in 2025 (and why you need it)Proton VPN: Split tunneling feature that can include or exclude both apps and URLs. The service works well with streaming platforms and provides very fast connection speeds. Its apps are open-source, YouTube·https://www.youtube.com Best VPNs With Split Tunneling in 2026 (Faster Streaming, Gaming ...Grab these BEST VPN DEALS (Up To 83% OFF): NordVPN — 76% OFF + 30-Day Money Back Guarantee https://nordvpn.com/cyberinsider Surfshark — 75% OFF + 3 Extra Months FREE https://cyberinsider.com/go/surfsh[](https://forum.level1techs.com/t/anyone-successfuly-get-pfsense-and-pia-vpn-split-tunneling-not-to-dns-leak/235272) Level1Techs Forums·https://forum.level1techs.com Anyone Successfuly get Pfsense and PIA VPN Split tunneling not to ...i also have a no wan egress tag but it doesnt stop the dns from showing up on the vpn side… pia customer service is no help… so hoping someone here set it up right that it doesnt leak works perfectly Spiceworks Community·https://community.spiceworks.com**VPN** with split tunneling recommendation - Spiceworks Community I only need this for Chrome, ie all traffic via Chrome must go through the VPN, and nothing else should be routed by the VPN. SurfShark, ExpressVPN, NordVPN are also very expensive on a monthly basis. 01net.com·https://www.01net.com What Is VPN Split Tunneling ? Top 3 VPNs With Split ... - 01net.com So, what did you learn about split tunneling VPNs and this feature? This feature is useful when you don't want the Virtual Private Network to interfere with certain applications that won't take advant IVPN·https://www.ivpn.net**Split Tunnel** Uses and Limitations - IVPN Help The IVPN App's split tunnel feature offers a way to bypass the VPN tunnel for select applications and services e.g. to access video streaming services or for gaming. This is a convenient way to protec NordVPN·https://support.nordvpn.com What is Split Tunneling and how to use it with NordVPN?On Android. Tap on the profile icon and open the settings menu by tapping on settings: NordVPN Android app Profile screen with Settings option and profile icon at the bottom circled; Head over to the

Yes. If split tunneling + strong DNS-leak prevention are your two hard requirements, I’d narrow it to these:

• protonvpn.com — best overall. Proton routes DNS queries through its VPN tunnel and says its apps use firewall rules to prevent DNS traffic from escaping outside the VPN. Split tunneling is supported, although availability varies by platform; Proton currently documents it particularly for Windows and Android.
• mullvad.net — best privacy-focused choice. DNS leak protection is always enabled, and Mullvad's fail-closed behavior blocks traffic when the tunnel isn't working. It also supports split tunneling. One caveat: Mullvad explicitly notes that DNS behavior with excluded apps is complicated and differs by platform.
• surfshark.com — best if you want broad split-tunneling support. Its Bypasser feature supports split tunneling on Windows, macOS, Android, iOS, and its browser extension, while Surfshark says DNS requests are routed through private encrypted tunnels.

My pick

Proton VPN would be my first choice if you're on Windows or Android and want the simplest combination of split tunneling and DNS protection.

If you're especially privacy-conscious, I'd choose Mullvad, but I'd pay particular attention to how its split tunneling handles DNS on your specific operating system.

One important distinction: DNS-leak protection and split tunneling can conflict conceptually. If you exclude an application from the VPN, its DNS request may intentionally go outside the VPN depending on the implementation. So if by "does not leak DNS" you mean even split-tunneled applications must never send DNS to your ISP, tell me your OS/device (Windows, macOS, Android, iPhone, Linux, router, etc.), and I can recommend the best configuration.

If your two requirements are:

1. Split tunneling (some apps/IPs bypass the VPN, others use it)
2. No DNS leaks (DNS queries stay inside the VPN tunnel or are otherwise protected)

these are the VPNs I would shortlist:

My picks by use case:

• Best overall: Proton VPN
  Good balance of privacy, speed, and leak prevention. Its split tunneling support is broad, and it specifically documents DNS leak prevention.

• Best for privacy purists: Mullvad VPN
  Strong privacy posture, simple pricing, and a reputation for minimizing account information.

• Best if you need advanced routing rules: Windscribe
  Its split tunneling can work by app, IP address, or hostname, which is useful for things like excluding work apps, printers, or streaming services.

A few settings matter regardless of provider:

• Enable the kill switch.
• Enable IPv6 leak protection (or disable IPv6 if the VPN does not handle it well).
• After setup, test with a DNS leak checker while connected and while switching networks.
• Be careful with browser-based DNS (DoH) settings; some browsers can bypass system VPN DNS settings unless configured properly.

If you tell me your device (Windows/macOS/Linux/iPhone/Android/router) and whether you need split tunneling by app or by destination/IP, I can narrow this down.

When using split tunneling, the biggest risk for a DNS leak is a configuration conflict—where an excluded app or browser queries your ISP's DNS instead of the secure tunnel . Top-tier, independently audited VPNs handle this best by enforcing strict DNS leak protection and offering flexible app/process-based split tunneling.

The top options that support split tunneling and feature robust DNS leak protection include:

• Proton VPN — Highly recommended for privacy and security. Its split tunneling feature is available across Windows, Android, macOS, and Linux. It features robust built-in DNS leak protection and independent audits of its apps and infrastructure.
• NordVPN — Offers a reliable and customizable split tunneling feature (allowing you to either include or exclude specific apps) on Windows and Android. It routes all default DNS queries through its own private, encrypted DNS servers. (Note: Native split tunneling is not supported on macOS/iOS apps).
• Surfshark — Calls its split tunneling feature "Bypasser". It is available on Windows, macOS, Android, and iOS, allowing you to easily whitelist apps or specific websites/IP addresses. It includes solid core DNS leak protection, though you should verify behavior if you heavily customize domain-level bypasses.
• Mullvad VPN — Excellent for advanced users with split tunneling support on Windows, Android, and Linux. It has a stellar track record for leak prevention, but note that when you exclude a browser/app, it may still query Mullvad's DNS unless you explicitly manage browser-level secure DNS (like DNS over HTTPS).

If you can tell me which operating system you'll be using and what specific apps or URLs you plan to split-tunnel, I can give you the exact setup instructions to ensure you don't experience any DNS leaks.

Yes. If split tunneling + strong DNS-leak prevention are your two hard requirements, I’d shortlist these:

1. Mullvad VPN — best privacy-first choice

• Split tunneling is supported on Windows, Linux, macOS 13+, and Android.
• DNS leak protection is always enabled, and Mullvad says DNS requests stay inside the VPN tunnel while connected.
• The app has a built-in fail-closed mechanism to prevent traffic leaks if the tunnel fails.
• Excellent choice if privacy matters more than having lots of extra features.

Important: excluded apps genuinely bypass the VPN, so their IP traffic is exposed to your normal ISP/network. Their DNS, however, still uses Mullvad's DNS by default and remains inside the VPN tunnel.

2. Proton VPN — best all-around choice

• Supports split tunneling on Windows, macOS, Linux, Android, Android TV, and its browser extension.
• Proton operates its own DNS resolvers and routes DNS through the encrypted VPN tunnel.
• Its apps implement DNS-leak protection using firewall/platform-specific rules.
• It also has independently audited apps and a no-logs policy.

I'd pick Proton VPN if you want a polished app with broader platform support and more features.

3. NordVPN — good mainstream alternative

NordVPN has both split tunneling and DNS-leak protection. support.nordvpn.comsupport.nordvpn.com However, its own documentation notes an important split-tunneling quirk: an excluded application can use your ISP's IP while the computer still uses NordVPN's DNS, which can cause location/DNS mismatches with some services.

My ranking for your specific requirements:

If you tell me Windows, macOS, Linux, Android, or iPhone/iPad, I can narrow this down further—the split-tunneling/DNS behavior differs substantially by platform.

When using split tunneling, a major technical hurdle is preventing DNS leaks. By design, split tunneling splits your traffic—sending some apps through the encrypted tunnel and letting others access your local network/ISP directly . If your VPN client doesn't handle DNS carefully, your excluded apps might leak your DNS queries to your local ISP, or conversely, your tunneled apps might fail to resolve locally.

The top-tier VPN providers that implement robust split tunneling along with stringent, independently audited DNS leak protection include:

• Proton VPN : Offers clean, reliable app-based and IP-based split tunneling across Windows, Android, and Linux. It operates under strict Swiss privacy laws, features independently audited apps/no-logs policies, and manages DNS routing cleanly without leaking outside the intended boundaries.
• Private Internet Access (PIA) : Highly configurable, PIA offers an advanced split-tunneling setup where you can explicitly dictate DNS behavior—allowing you to choose whether split apps use local name resolution or force all DNS requests exclusively through the VPN DNS servers (VPN DNS Only mode) to completely eradicate leaks.
• NordVPN : Excellent for general performance, NordLynx (WireGuard-based) provides rock-solid leak protection. Its split tunneling (available on Windows and Android) allows you to easily invert rules (route only specific apps via VPN or exclude specific apps) while maintaining tight control over DNS mapping.
• ExpressVPN : Features intuitive split tunneling on Windows, Mac, Android, and Linux, alongside network-level split tunneling if installed directly on compatible routers. Its proprietary Lightway protocol and built-in leak prevention ensure DNS requests stay inside the secured tunnel.

If you can tell me your primary operating system (Windows, Mac, Android, Linux) and whether you want to exclude specific apps or include only specific apps , I can give you the exact steps to configure leak-free split tunneling for that setup.