@@ -126,6 +126,50 @@ The VPN client or server shall detect when multiple clients are using credential
| any | AUTH-1, AUTH-2 |
| DAT >= 1 | AUTH-3, AUTH-4 |
### 5.2.X **[TR-DNSL]** DNS leak prevention
The VPN client shall prevent all DNS queries originating from the device from being resolved by non-authorized servers while the VPN connection is active, unless explicitly authorized by the user.
#### 5.2.X.x **[MI-DNSL-1]** Exclusive DNS routing
The VPN client shall route all DNS queries through the VPN connection to authorized DNS servers.
* Test: with the VPN connected, perform concurrent DNS lookups while capturing traffic on all network interfaces
* Result: all DNS traffic shall be routed exclusively through the VPN connection to authorized DNS servers
* Documentation: a list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries
#### 5.2.X.x **[MI-DNSL-2]** DNS fallback prevention
The VPN client shall prevent the operating system or applications from sending DNS queries to non-authorized servers during a VPN disconnection or network interface change.
* Test: with the VPN connected, simulate a VPN connection failure and a network interface change while capturing traffic on all network interfaces
* Result: no DNS queries are sent to any IP address not belonging to the VPN service
* Documentation: a description of the simulated disruption methods, a list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries
#### 5.2.X.x **[MI-DNSL-3]** DNS misconfiguration
The VPN client shall inspect the system DNS configuration when attempting to connect and shall validate any DNS configuration it receives from the VPN server. If it detects a statically configured, non-authorized DNS server, the client shall either reject the configuration, refuse to connect, or provide a clear warning to the user.
* Test: perform two separate tests: (1) manually configure the operating system primary network interface to use a public DNS server not associated with the VPN provider and attempt to connect, (2) connect to a test VPN server that is configured to push a public DNS server IP address to the client
* Result: in both tests, the client shall detect the conflicting DNS setting and either refuse the connection or display an explicit warning to the user detailing the risk of a DNS leak
* Output: client logs or screenshots demonstrating that the conflicting DNS configuration was detected and that the appropriate action was taken
* Documentation: a description of the client validation for both local and server-provided DNS settings
#### 5.2.X.x **[MI-DNSL-4]** Secure DNS protocols
The VPN client shall prevent DNS queries from bypassing the VPN connection via encrypted DNS protocols, including DNS over TLS (DoT) and DNS over HTTPS (DoH), unless explicitly authorized by the user.
* Test: with the VPN connected, the test shall be performed separately for both DNS over TLS (DoT) and DNS over HTTPS (DoH), configure the operating system or an application to use a public DNS provider for that protocol, then generate DNS requests while capturing traffic on all network interfaces
* Result: in both tests, the DNS queries shall either be blocked or be resolved by the VPN authorized DNS servers
* Documentation: a description of the method used to prevent DNS over TLS (DoT) and DNS over HTTPS (DoH) leaks, a list of authorized DNS server IP addresses, a packet capture showing the destination of all DNS queries
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
