From the source of https://www.dnsleaktest.com/:
<iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe>
<iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe>
<iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe>
That site generates a random host name and arranges for your browser to request content from that host name. Since the host name has never been served to anyone else before, your browser's request to resolve it is sure to make its way to the primary server for the
dnsleaktest.com domain. Since they run their own DNS, whoever they receive the DNS requests from is your DNS provider.
Whether forcing your DNS traffic to go through a tunnel instead of via your ISP depends on who you want privacy from. If you don't want the sites you visit to know where you're from, it's a mild leak: most sites don't bother to track where your DNS requests come from, and anyway they'd have a hard time figuring out which ones are yours, and your requests are likely to be served by some cache anyway. However any site could use the same trick as dnsleaktest if they cared. If you're using a tunnel because you don't want your ISP to know which sites you're visiting, making sure that no DNS request ever reaches your ISP is crucial.