“Normally, when a user is connected to ExpressVPN, their DNS requests are sent to the company’s servers.”
From version 12.23.1 in May 2022 through 12.72.0, ExpressVPN’s Windows client sent some DNS requests to a third party, usually the user’s ISP, whenever split tunneling ran in “Only allow selected apps” mode. The ISP could see every domain visited. ExpressVPN says fewer than 1% of Windows users were affected and that the traffic itself stayed encrypted. The one party a VPN customer pays to hide from got the list of sites for almost two years.