diff --git a/cmd/cli/cli.go b/cmd/cli/cli.go
index b56cee2..9e6a391 100644
--- a/cmd/cli/cli.go
+++ b/cmd/cli/cli.go
@@ -184,9 +184,10 @@ func initCLI() {
 
 			status, err := s.Status()
 			isCtrldInstalled := !errors.Is(err, service.ErrNotInstalled)
+			isCtrldRunning := status == service.StatusRunning
 
 			// If pin code was set, do not allow running start command.
-			if status == service.StatusRunning {
+			if isCtrldRunning {
 				if err := checkDeactivationPin(s, nil); isCheckDeactivationPinErr(err) {
 					os.Exit(deactivationPinInvalidExitCode)
 				}
@@ -308,18 +309,25 @@ func initCLI() {
 			}
 
 			tasks := []task{
+				{func() error {
+					// Always reset DNS first, ensuring DNS setting is in a good state.
+					// resetDNS must use the "iface" value of current running ctrld
+					// process to reset what setDNS has done properly.
+					oldIface := iface
+					iface = "auto"
+					if isCtrldRunning {
+						iface = runningIface(s)
+					}
+					if isCtrldInstalled {
+						resetDnsNoLog(p)
+					}
+					iface = oldIface
+					return nil
+				}, false},
 				{s.Stop, false},
 				{func() error { return doGenerateNextDNSConfig(nextdns) }, true},
 				{func() error { return ensureUninstall(s) }, false},
 				{func() error {
-					// If ctrld is installed, we should not save current DNS settings, because:
-					//
-					// - The DNS settings was being set by ctrld already.
-					// - We could not determine the state of DNS settings before installing ctrld.
-					if isCtrldInstalled {
-						return nil
-					}
-
 					// Save current DNS so we can restore later.
 					withEachPhysicalInterfaces("", "save DNS settings", func(i *net.Interface) error {
 						return saveCurrentStaticDNS(i)
diff --git a/cmd/cli/prog.go b/cmd/cli/prog.go
index d2ea7a9..8dd83b5 100644
--- a/cmd/cli/prog.go
+++ b/cmd/cli/prog.go
@@ -452,11 +452,12 @@ func (p *prog) setDNS() {
 	if iface == "" {
 		return
 	}
+	runningIface := iface
 	// allIfaces tracks whether we should set DNS for all physical interfaces.
 	allIfaces := false
-	if iface == "auto" {
-		iface = defaultIfaceName()
-		// If iface is "auto", it means user does not specify "--iface" flag.
+	if runningIface == "auto" {
+		runningIface = defaultIfaceName()
+		// If runningIface is "auto", it means user does not specify "--iface" flag.
 		// In this case, ctrld has to set DNS for all physical interfaces, so
 		// thing will still work when user switch from one to the other.
 		allIfaces = requiredMultiNICsConfig()
@@ -465,8 +466,8 @@ func (p *prog) setDNS() {
 	if lc == nil {
 		return
 	}
-	logger := mainLog.Load().With().Str("iface", iface).Logger()
-	netIface, err := netInterface(iface)
+	logger := mainLog.Load().With().Str("iface", runningIface).Logger()
+	netIface, err := netInterface(runningIface)
 	if err != nil {
 		logger.Error().Err(err).Msg("could not get interface")
 		return
@@ -520,14 +521,15 @@ func (p *prog) resetDNS() {
 	if iface == "" {
 		return
 	}
+	runningIface := iface
 	allIfaces := false
-	if iface == "auto" {
-		iface = defaultIfaceName()
+	if runningIface == "auto" {
+		runningIface = defaultIfaceName()
 		// See corresponding comments in (*prog).setDNS function.
 		allIfaces = requiredMultiNICsConfig()
 	}
-	logger := mainLog.Load().With().Str("iface", iface).Logger()
-	netIface, err := netInterface(iface)
+	logger := mainLog.Load().With().Str("iface", runningIface).Logger()
+	netIface, err := netInterface(runningIface)
 	if err != nil {
 		logger.Error().Err(err).Msg("could not get interface")
 		return