Ran into a weird silent DNS leak over IPv6 while using Encrypted DNS (NextDNS)—here is what I found and how IPv6 handled it differently on my setup

TL;DR

I ran into an issue on my dual-stack network where my gateway was set up for Encrypted DNS (DoH/DoT), but my clients were still leaking plain-text queries directly to my ISP over IPv6. In my experience, this happens because IPv6 DNS discovery handles defaults differently than IPv4—leaving IPv6 DNS on "Auto" allowed my router to pass upstream ISP IPv6 DNS resolvers straight to my devices.

What Was Happening Under the Hood (In My Experience)

1. IPv4 vs. IPv6 Resolver Behavior: In my IPv4 setup, the router acts as the primary resolver and hands out its own LAN IP (192.168.1.1) via DHCP Option 6. All IPv4 traffic hits the local proxy daemon, encrypts, and forwards out. With IPv6, my network relied on SLAAC and Router Advertisements (RA) via RDNSS. Because my router's IPv6 DNS setting was left on Auto, during DHCPv6 Prefix Delegation (PD) the router automatically grabbed my ISP’s upstream IPv6 DNS servers and broadcasted those ISP addresses directly to every client on the LAN.

How I Checked for the Leak

• Checking active adapters: Running ipconfig /all on Windows showed my local router IP alongside an ISP-owned 2601:... IPv6 address under DNS Servers.

How I Fixed It

In my experience, the fix was explicitly overriding the IPv6 DNS settings in the unifi console so the ISP’s upstream IPv6 resolvers were never advertised to local clients:

• Setting IPv6 DNS to Manual: Under my network's IPv6 configuration, I switched IPv6 DNS Control from Auto to Manual and set the primary IPv6 DNS server to my router's local LAN IPv6 interface address (2601:...::1). This forced all IPv6 DNS traffic back through the local encrypted proxy.

Curious to Hear Your Thoughts

Has anyone else run into this silent IPv6 leak behavior on dual-stack setups?