is it supposed to safeguard against dns leaks? in my cursory tests, it looks like it doesn’t