diff --git a/WireGuard/WireGuardNetworkExtension/PacketTunnelSettingsGenerator.swift b/WireGuard/WireGuardNetworkExtension/PacketTunnelSettingsGenerator.swift
index d26d802..4007196 100644
--- a/WireGuard/WireGuardNetworkExtension/PacketTunnelSettingsGenerator.swift
+++ b/WireGuard/WireGuardNetworkExtension/PacketTunnelSettingsGenerator.swift
@@ -75,7 +75,9 @@ class PacketTunnelSettingsGenerator {
         // DNS
 
         let dnsServerStrings = tunnelConfiguration.interface.dns.map { $0.stringRepresentation() }
-        networkSettings.dnsSettings = NEDNSSettings(servers: dnsServerStrings)
+        let dnsSettings = NEDNSSettings(servers: dnsServerStrings)
+        dnsSettings.matchDomains = [""] // All DNS queries must first go through the VPN's DNS
+        networkSettings.dnsSettings = dnsSettings
 
         // MTU