Maybe it's because you have the dns ip on the allowed ips list, causing the dns queries to go through the tunnel? tcpdump or a similar tool may be helpful in t

Maybe it's because you have the dns ip on the allowed ips list, causing the dns queries to go through the tunnel? tcpdump or a similar tool may be helpful in this case to see where / how traffic is handled.