Comment 46 for bug 1624317

Thomas:

I am not an expert on this, but as far as I can tell from the documentation you are seeing a different dns replying at times because (I quote the systemd.resolved.service doc) "Multi-label names are routed to all local interfaces that have a DNS sever configured (...) If lookups are routed to multiple interfaces, the first successful response is returned".

So basically all the dns servers defined in all of your links are fair game. DNS requests are sent to all of them at the same time and whichever replies first win the day!

My understanding is that you have to specify dhcp-options DOMAIN-ROUTE . in your openvpn connection settings to force dns requests to all domains to go through the vpn link and ignore the dns on other links.