

Then once the DNS has been resolved into an IP, THEN it goes over your encrypted VPN by connecting via IP address. Basically in this scenario, it is using your router, and by proxy, your ISP to resolve DNS over your public unencrypted internet connection. If the VPN does not change your DNS settings upon connecting, then your computer may continue to resolve IP's using your router and there for in turn your ISP to resolve DNS names. One of the things VPN configurations/software can or may not do is reconfigure your DNS settings when creating a VPN.

When a VPN is create it can be created with literally hundreds of differant types of configurations, protocols, software etc. So on your device you might see that the DNS server is the same as the IP of your router. The most typical configuration at residential customer networks is users Linksys/Netgear/etc router acts as a local DNS server, and it, in turn, connects to what ever your ISP provides it to actually resolve DNS. Devices consult DNS servers to resolve DNS names into IP addresses. This process of resolving "friendly" names to IP addresses is called DNS "Domain Name System". Once a name has been resolved into an IP thats when the device can ACTUALLY connect to a remote resource (by connecting to the remote resources IP address). Devices resolve "friendly" names like "into IP addresses.
