DNS traffic can leak outside the VPN tunnel on Android

FYI android notifications bypass VPN, same for captive portals. Always been the case.