Your lookups stay inside the tunnel.

A VPN that connects but leaves your DNS where it was is a leak that looks like success — Litora does not do that.

The mechanism

Every gateway runs its own recursive resolver — answering from the root, never forwarding to a big public one — and query logging is off.

DNSSEC validation is on, so a site with broken DNSSEC will not resolve — that is protection from a forged answer, not an outage.