The report detailed how the user managed to leak DNS queries when disabling and enabling VPN while having “Block connections without VPN” on. The leak during tunnel reconnects is harder for us to mitigate in our app. Apps may still leak DNS traffic during the conditions mentioned above, and as previously reported it still leaks connection check traffic.

Source: DNS traffic can leak outside the VPN tunnel on Android | Mullvad VPN

Ugh

Also, Mullvad is behind the Mozilla VPN