diff --git a/NEWS b/NEWS
index 20e4980e..8b9204b9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,8 @@
 * Version 1.5.0 (unreleased)
-- Fixed sudden disconnects after authentication for AnyConnect clients
+- Fixed sudden disconnects after authentication for AnyConnect clients (#706)
 - Vhosts now inherit configuration options from the default vhost if
   they are not overridden (#705)
+- `tunnel-all-dns` now works correctly when set in per-user/group config (#708)
 
 
 * Version 1.4.2 (released 2026-04-16)
diff --git a/src/worker-vpn.c b/src/worker-vpn.c
index ae83a20f..f61c67c6 100644
--- a/src/worker-vpn.c
+++ b/src/worker-vpn.c
@@ -2321,10 +2321,10 @@ static int connect_handler(worker_st *ws)
 
 	} else {
 		/* default route */
-		WSRCONFIG(ws)->tunnel_all_dns = 1;
+		ws->user_config->tunnel_all_dns = 1;
 	}
 
-	if (WSRCONFIG(ws)->tunnel_all_dns) {
+	if (ws->user_config->tunnel_all_dns) {
 		ret = cstp_puts(ws, "X-CSTP-Tunnel-All-DNS: true\r\n");
 	} else {
 		ret = cstp_puts(ws, "X-CSTP-Tunnel-All-DNS: false\r\n");
diff --git a/tests/data/test-user-config.config b/tests/data/test-user-config.config
index aadef830..78137f25 100644
--- a/tests/data/test-user-config.config
+++ b/tests/data/test-user-config.config
@@ -151,6 +151,8 @@ split-dns = example.com
 #ipv6-mask =
 #ipv6-dns =
 
+tunnel-all-dns = false
+
 # Prior to leasing any IP from the pool ping it to verify that
 # it is not in use by another (unrelated to this server) host.
 ping-leases = false
diff --git a/tests/test-user-config b/tests/test-user-config
index 5286c1f3..f3d59283 100755
--- a/tests/test-user-config
+++ b/tests/test-user-config
@@ -151,9 +151,27 @@ fi
 
 echo ok
 
+echo -n "Checking if user-specific 'tunnel-all-dns: true' has been sent... "
+CONTENTS=`cat ${TMPFILE1}|grep X-CSTP-Tunnel-All-DNS|grep true`
+if test -z "$CONTENTS";then
+	cat ${TMPFILE1}|grep X-CSTP-Tunnel-All-DNS
+	fail $PID "Expected 'X-CSTP-Tunnel-All-DNS: true' but it was missing or incorrect"
+fi
+
+echo ok
+
 rm -f ${TMPFILE1}
 rm -f ${TMPFILE2}
 
+
+sed -i 's/tunnel-all-dns = false/tunnel-all-dns = true/g' ${CONFIG}
+if ! grep 'tunnel-all-dns = true' ${CONFIG} >/dev/null;then
+	fail $PID "Configuration update failed: 'tunnel-all-dns = true' not found in ${CONFIG}"
+fi
+echo Reloading ocserv...
+kill -HUP $PID
+sleep 4
+
 echo -n "Re-connecting to check the ipv4-network... "
 $OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true </dev/null >${TMPFILE1} 2>&1 & kpid3=$!
 
@@ -182,6 +200,15 @@ fi
 
 echo ok
 
+echo -n "Checking if user-specific 'tunnel-all-dns: false' has been sent... "
+CONTENTS=`cat ${TMPFILE1}|grep X-CSTP-Tunnel-All-DNS|grep false`
+if test -z "$CONTENTS";then
+	cat ${TMPFILE1}|grep X-CSTP-Tunnel-All-DNS
+	fail $PID "Expected 'X-CSTP-Tunnel-All-DNS: false' but it was missing or incorrect"
+fi
+
+echo ok
+
 
 kill $kpid3
 rm -f ${TMPFILE1} ${CONFIG}
diff --git a/tests/user-config/testipnet b/tests/user-config/testipnet
index c3041d45..bc7850c2 100644
--- a/tests/user-config/testipnet
+++ b/tests/user-config/testipnet
@@ -1,2 +1,3 @@
 mobile-dpd = 880
 ipv4-network = 10.9.9.0/16
+tunnel-all-dns = false
diff --git a/tests/user-config/testuser b/tests/user-config/testuser
index bc40e246..c2008750 100644
--- a/tests/user-config/testuser
+++ b/tests/user-config/testuser
@@ -6,3 +6,4 @@ dns = 8.8.8.8
 hostname = xxxx
 split-dns = example5.com
 split-dns = example6.com
+tunnel-all-dns = true