ExpressVPN Split Tunneling DNS Leak: Disabled?
ExpressVPN temporarily disabled split tunneling for some users while it patched a DNS leak that could expose browsing activity. The issue affected the feature on certain platforms and configurations, and the company rolled out fixes to restore functionality without compromising privacy.
What Happened With Split Tunneling
Split tunneling lets you route some apps or websites through the VPN while others use your regular internet connection. In early 2023, some users reported that the feature was missing or grayed out in the ExpressVPN app after an update. The company confirmed that it had temporarily disabled split tunneling to address a DNS leak that could send DNS requests outside the encrypted tunnel for apps not selected for VPN routing.
DNS leaks happen when your device asks a DNS resolver (like your ISP’s) to translate a domain name into an IP address, and that request goes outside the VPN tunnel. Even if your traffic is encrypted, the DNS query reveals which sites you visit. ExpressVPN’s fix involved changing how the app handles DNS for split-tunneled apps, and the feature was gradually re-enabled after testing.
How Split Tunneling Works in ExpressVPN
ExpressVPN offers two modes of split tunneling:
- App-based: You choose which applications use the VPN. Other apps go directly to the internet.
- Website-based (on some platforms): You specify domains that should bypass the VPN, while everything else stays protected.
When split tunneling is active, the VPN creates a routing rule that sends selected traffic through the encrypted tunnel and the rest through your normal gateway. The DNS settings must also be split: the VPN’s DNS should handle only the tunneled traffic, and your regular DNS should handle the rest. If the split is imperfect, DNS queries from non-VPN apps can leak.
Why the DNS Leak Occurred
The leak was tied to how the app handled DNS on certain operating systems. On Windows, for example, ExpressVPN uses a virtual network adapter and sets system-wide DNS. When split tunneling was enabled, the app had to override that for specific apps or domains. In some versions, the override didn’t apply correctly, so DNS queries from apps that were supposed to bypass the VPN still went through the VPN’s DNS—or worse, the VPN’s DNS was bypassed for all traffic.
On Android, the VPN service uses a per-interface DNS, but split tunneling can interfere with that. A misconfiguration could cause DNS requests to be sent to the default resolver (often the ISP) instead of ExpressVPN’s private DNS. The company detected this during internal testing and proactively disabled the feature to prevent user exposure.
How ExpressVPN Fixed It
The fix involved updating the DNS routing logic in the app. ExpressVPN moved to a more granular approach, ensuring that each app or domain gets the correct DNS server. They also added a DNS leak test inside the app so users could verify their configuration after enabling split tunneling.
The rollout was gradual: first on Windows, then Android, then other platforms. The company communicated the change through its support page and social media, advising users to update the app to the latest version to get the fix and re-enable split tunneling.
How to Check for DNS Leaks Yourself
If you use split tunneling, you can verify that it’s working correctly:
- Visit a DNS leak test website (like dnsleaktest.com or ipleak.net) while connected to the VPN.
- Run the standard test. It should show ExpressVPN’s DNS servers and your VPN IP.
- Enable split tunneling for a specific app (e.g., a browser) and run the test again from that app. It should still show the VPN DNS.
- Run the test from an app that is NOT tunneled. It should show your ISP’s DNS and your real IP.
If you see your ISP’s DNS in the tunneled app, you have a leak. In that case, disable split tunneling and contact support.
Common Misconceptions About Split Tunneling
Some users think split tunneling means the VPN is “off� for those apps, but that’s not accurate. The VPN tunnel is still active for the rest of your traffic; only the selected apps bypass it. Another misconception is that split tunneling is a security feature. It’s a convenience feature—it lets you access local devices (like a printer) or use services that block VPN IPs (like some banking apps) while keeping other traffic protected. The DNS leak was a bug, not a design flaw.
Alternatives to Split Tunneling
If you don’t want to deal with split tunneling, you have options:
- Use the VPN for everything: This is the most private setup, but you lose access to local network devices unless the VPN supports local network access.
- Use a router-based VPN: Some routers let you configure VPN per device, which is a form of split tunneling at the network level.
- Use a different VPN provider: Other providers have split tunneling, but they may have had similar issues. Always check the latest reviews.
Frequently Asked Questions
Is split tunneling safe to use now?
Yes, after the fix, ExpressVPN re-enabled split tunneling. As long as you update the app to the latest version, the DNS leak is patched. You can verify with a leak test.
Why did ExpressVPN disable split tunneling without warning?
The company likely did it to protect users immediately rather than wait for a public announcement. They communicated the change through support pages and social media shortly after.
Does split tunneling affect my VPN speed?
It can improve speed for non-tunneled apps because they don’t go through the VPN encryption. For tunneled apps, speed is the same as without split tunneling.
Can I use split tunneling on all devices?
No. It’s available on Windows, Android, and some routers. It’s not available on iOS or macOS due to system limitations.
What should I do if I see a DNS leak after updating?
Disable split tunneling, run a leak test again, and if the leak persists, contact ExpressVPN support. They can guide you through reconfiguring your DNS settings.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.