sonicbackdrop That sounds interesting. I've never used those kind of DNS services on my phone. Setting the 'Private DNS' option to a service like that is applied across all profiles and is even used instead of the default DNS service in any VPNs which is not something I think is too good at all. Also I think it's still just DNS over HTTPS/2 or DOT which have issues like SNI that can leak your DNS requests anyway.
I assume, however, this is an app that uses the VPN slot? Does it let you use different SOCKS5 proxies at the same time?
It's a shame those 'firewall' apps don't block DNS queries, I used to use 'NetGuard' but stopped once I moved over to GrapheneOS as the per app network toggle is much better for that kind if thing