We reproduced similar behavior on iOS 27: some selected traffic bypassed our intended tunnel/proxy path with Connectivity Assist enabled. Turning Assist off stopped it. In our physical-device tests, the working combination was: Explicit non-default included routes alongside the ordinary default routes. enforceRoutes = true includeAllNetworks = false DNS allowFailover = false The route configuration mattered: Apple explains that enforcement does not apply to default routes. Simply changing the enforcement flag without adjusting the included routes was insufficient. After changing the saved VPN configuration, we fully disconnected and reconnected. Disabling enforcement with the same routes brought the bypass back in our reproducing case. DNS failover remained disabled throughout that comparison. This may be another useful configuration to compare. Our app forwards selected traffic to a remote proxy, we haven’t tested your complete DNS-response cases or NEDNSProxyProvider, so we can’t confirm this resolves your implementation. It also doesn’t change DTS’s guidance about DNS-only use of packet tunnels.