When using NetworkManager with the OpenVPN plugin and connecting to a VPN that pushes DNS addresses, those addresses are _appended_ to the resolv.conf instead of replacing existing ones. The current behaviour can and will cause DNS leaks to occur, as soon as the DNS servers pushed by the VPN are not reachable (or even before that) and resolver cycles to the local nameserver (http://man7.org/linux/man-pages/man5/resolv.conf.5.html) given by the ISP. I have even observed that the local nameserver is on the first line, causing DNS leaks to occur outright.

The default behavior should be to prevent DNS leaks and only to use the DNS nameservers explicitly pushed by the VPN. I think in my case the NetworkManager collects the configured nameservers in the order that the connections were established -- i.e. first the nameserver of my ethernet (local) and then the nameservers pushed by the VPN and then writes them to /etc/resolv.conf

Current workarounds include manually specifying the set of DNS servers provided by the VPN for the ethernet connection and the VPN, or simply not using NetworkManager, instead relying on openvpn + update-resolv-conf directly (which works).