It doesn't really "leak" DNS, because it has no concept really of DNS resolution. It's a virtual network interface. It will not mess with your resolv.conf. Are

It doesn't really "leak" DNS, because it has no concept really of DNS resolution. It's a virtual network interface. It will not mess with your resolv.conf. Are you tunneling out of AWS, or are you using some AWS node as a wireguard server? Sounds like the former with wireguard interface being the default gateway (I am not an AWS user and am just guessing)... Adding a route for the AWS DNS server IP(s) to use the real network interface for traffic instead of the wireguard interface might work. Something like ip route add <AWS DNS server IP, or AWS subnet) dev <normal network interface such as eth0> e.g. ip route add 10.0.0/24 dev eth0 Of course, that will make DNS traffic bypass wireguard. If your goal is to hide your DNS queries from AWS except for internal AWS queries, then you will indeed have to run some local resolver that is set up to use the AWS DNS server for AWS-internal queries and some other server (be it a local one or some public one) for everything else.