How to Fix DNS Leak on macOS

macOS can keep old resolver state after network transitions. Mixed Wi-Fi/VPN resolver ordering is a common leak source.

1. Connect VPN first, then verify DNS servers in Network settings for the active interface.
2. Move VPN service priority above Wi-Fi/Ethernet in macOS network service order.
3. Flush local resolver cache with `sudo dscacheutil -flushcache` and retry.
4. Disable browser secure DNS overrides if they conflict with your VPN profile.
5. Run quick test first, then deep test to confirm resolver stability.