Who: VPN users, privacy‑conscious consumers, journalists, and enterprises using split tunneling.

What: A July 2026 update to the April 2026 analysis showing how nine “safe” split‑tunneling setups continue to leak and what changed this year—IPv6 growth, encrypted DNS defaults, and OS‑level networking shifts—and exactly how to plug those leaks.

When & Where: July 2026, desktop and mobile environments worldwide as major OS and browser vendors adjusted DoH/DoT defaults and several VPN vendors hardened tunnel DNS settings in 2025–2026.

Why this matters: Faster IPv6 deployment and ubiquitous encrypted DNS routinely expose tiny correlation points—DNS queries, update checks, telemetry—that can re‑identify you even when your main traffic is tunneled. If you rely on split tunneling for performance or local access, these side channels matter now more than ever.

Context: what shifted between April and July 2026

Two clear trends accelerated in mid‑2026 and change the calculus for split tunneling:

  • Higher IPv6 traffic share: IPv6 usage continued rising across mobile carriers and home ISPs in early 2026. More endpoints prefer IPv6 by default, and many legacy VPNs still handle IPv4 first—giving IPv6 a stealth route out of tunnels unless explicitly managed.
  • Encrypted DNS (DoH/DoT) moved from opt‑in to default in more environments: Browsers and some OS distributions now default to DoH/DoT but choose resolvers dynamically. That makes DNS routing a first‑class routing decision, not a background setting.

Consequence: split tunneling is no longer a narrow engineering tradeoff. It’s become a systems problem spanning OS settings, browser resolvers, per‑process networking, and CDN/AI model fetches that happen without visible user interaction.

What vendors and standards did in 2025–mid‑2026

  • Major VPN providers—NordVPN, Proton (ProtonVPN), ExpressVPN and Mullvad among them—rolled out mandatory tunnel DNS options and explicit IPv6 controls in late 2025 and into 2026. Defaults vary, so “the provider supports IPv6” is not the same as “it tunnels IPv6 by default.”
  • Browser vendors (Mozilla and Cloudflare collaboration, Google Chrome policies) added clearer DoH permissions and enterprise policies in the 2025–2026 release cycle; enterprises can now direct DoH to resolvers reachable inside tunnels via policy.
  • OS vendors continued adding per‑app network namespace features: Linux containers and Android’s network APIs are being used to isolate tunneled apps, while macOS and iOS improvements made it easier for some VPNs to bind flows to virtual interfaces.

The 2026 reality: nine “safe” split‑tunneling setups that still leak—and what changed

  1. Only your browser inside the VPN. Browsers now spawn more helper processes and background fetchers (extension updaters, isolated WebAssembly workers, background model downloads). Those processes can resolve DNS via the OS resolver or a DoH resolver outside the tunnel.
  2. Only one streaming app outside the VPN. Streaming SDKs and ad libraries make independent calls for analytics and device fingerprinting; several vendors have documented telemetry endpoints that can be reached on the clear net even when the main player is tunneled.
  3. Assuming app‑based rules include child processes. In mid‑2026 we saw multiple apps change packaging to add helper daemons that don’t inherit parent routing flags. Don’t assume an app rule covers its children.
  4. Mixing split tunneling with “Smart DNS.” Smart DNS services continue to intentionally answer queries from regional resolvers. If those resolvers are visible to your ISP while other flows are tunneled, you’ve built a fingerprint for correlation.
  5. Leaving DoH/DoT on “auto.” Default DoH selection can pick a resolver that’s reachable outside the VPN. As of 2026, treat DoH as a network policy: explicitly pin it to a resolver routed through the tunnel or disable it.
  6. Relying on "Always‑on VPN" without transition tests. Handoffs between Wi‑Fi and cellular, captive portal interactions, and power‑saving network suspensions can expose excluded apps briefly. Mobile stacks are still the most fragile area.
  7. Excluding password managers or authenticators. Excluding identity services remains a high‑risk convenience tradeoff—auth servers, token refreshes, and sync endpoints can leak identity when they reach the clear net.
  8. Using split tunneling with P2P without interface binding. P2P and torrent clients often rebind when IPs or adapters change; bind the client to the VPN interface if you must exclude P2P for performance.
  9. Trusting a green VPN icon. App icons and status lights still lie by omission. A “connected” status doesn’t prove per‑process traffic is tunneled—auditing is required.

New data and expert notes (July 2026)

Network privacy groups and independent labs reported an uptick in split‑tunnel correlation failures in Q1–Q2 2026 as DoH defaults and IPv6 adoption intersected. VPN vendors that shipped forced tunnel DNS and dual‑stack tunnels cut visible DNS/IP leak reports by over 70% in internal telemetry shared with partners; vendors that left DoH “auto” unchanged saw leak rates remain steady. That split in outcomes makes vendor defaults the single most important short‑term control.

"If your VPN doesn't let you pin DNS to the tunnel or toggle IPv6 routing, you are running with a fractional shield—some traffic is protected, some isn't, and that's enough for correlation." — network privacy engineer, July 2026

Updated 5‑minute split‑tunneling safety check (July 2026)

Run this after any update, provider change, or when you alter split rules.

Step 1 — Verify DNS path

  • Visit a reputable DNS leak test (ipleak.net, dnsleaktest.com, or Cloudflare's diagnostic page) and confirm both resolver IP and resolver hostname are routed through the VPN.
  • If your browser uses DoH/DoT, explicitly set the resolver to an address that resolves only via the VPN (many providers document tunnel‑reachable resolver IPs) or disable DoH for testing.

Step 2 — Check IPv4 and IPv6

Use an IP leak test that reports both. If your VPN lacks dual‑stack support, either disable IPv6 at the OS level or upgrade to a provider that supports IPv6 tunneling (look for “IPv6 dual‑stack” in provider docs).

Step 3 — Force a network transition

Toggle Wi‑Fi, connect to a mobile hotspot, or open a captive portal. Watch excluded apps for calls to external IPs during the transition; use packet capture (tcpdump/Wireshark) or the platform’s connection monitor.

Step 4 — Confirm process‑level routing

Map sockets to processes: Resource Monitor on Windows, lsof/netstat on macOS, ss/netstat on Linux. Confirm helper processes and child daemons follow your rules.

Step 5 — Re‑audit after updates and enforce DNS pinning

After any OS/browser/VPN update, re‑run checks. Use provider or enterprise policies to pin DoH to a resolver reachable through the tunnel and enable mandatory tunnel DNS when offered.

Impact: who loses and who should act

Casual streamers might accept occasional leaks for convenience. Journalists, activists, and enterprise users cannot. For enterprises, migrate from app‑name exclusions to route‑based exclusions (IP ranges, subnets) and require DNS over the tunnel via Group Policy or MDM. For individual users, prefer VPNs that offer mandatory tunnel DNS, IPv6 dual‑stack, and interface binding.

Reactions & vendor movements

Several large providers publicly updated documentation in H2 2025–H1 2026 to emphasize tunnel DNS and IPv6 handling. Smaller providers still vary. If your VPN forces DoH to its resolver and documents IPv6 handling clearly, that’s a material advantage—don’t accept vague marketing language.

What's next: what to watch for in late 2026

  • Wider vendor support for per‑namespace VPNing (Linux containers, Android network namespaces) as an easy way to isolate tunneled apps.
  • Browser and OS UI improvements that let users pin DoH resolvers per‑network or per‑profile—watch defaults after each release.
  • More providers offering audited dual‑stack tunnels; ask for proofs or tests if you rely on IPv6 protection.

Should I stop using split tunneling entirely?

No. Split tunneling still solves real problems—latency, local device access, and bandwidth. Treat it as an advanced feature: only use route‑based exclusions where possible, enforce tunnel DNS, and run the verification checklist after every change.

How do I stop IPv6 from leaking?

Preferred: use a VPN that explicitly supports IPv6 dual‑stack tunneling and confirm it in provider docs. Alternative: disable IPv6 at the OS level until you can confirm your VPN handles it.

What should I look for in a VPN provider today?

Key features: mandatory tunnel DNS (not optional), explicit IPv6 dual‑stack tunneling, per‑process interface binding or network namespace support, and documented enterprise policies for DoH pinning. Providers that publish configuration guides and leak‑test documentation are preferable.

How often should I audit my split rules?

After any VPN, OS, browser, or app update—and at minimum monthly if you regularly use split tunneling. Also re‑audit after changing networks (home ↔ office ↔ mobile hotspot).

Bottom line: Split tunneling remains a useful tool in July 2026—but the attack surface keeps growing. The fix is not fear; it’s verification. Pin DNS to the tunnel, manage IPv6 explicitly, bind interfaces when possible, and re‑test after every change. Do that and we keep the convenience without giving away the game.