AIUI here is the DNS situation ("leaks") when using an ISP, a VPN, and Tor.
Can someone please correct me if I am wrong / inaccurate.
If I am using my ISPs DNS then they can log the websites via my DNS requests.
If I am using a commercial VPN then the VPNs DNS logs the websites.
However, my ISP does not see the DNS requests (or the website since all
traffic flows through the encrypted VPN).
If I am using Tor then all DNS resolution is done by the Tor exit node. No
DNS requests leave my computer unencrypted - unlike in the previous two
examples.