https://github.com/GrapheneOS/os-issue-tracker/issues/6873
The "Always-on VPN" and "Block connections without VPN" settings are enabled, but disconnecting from the VPN via button in the Mullvad app still causes a non-tunneled DNS type A query for supl.grapheneos.org over the IPv6 connection (beside type A queries for ipv4.am.i.mullvad.net over IPv6 and IPv4).
Pixel 9a
Latest GrapheneOS (2025121701)
Latest Mullvad VPN app (2025.11)
I already read and followed the great documentation before reporting, so private DNS is turned off.
For me the DNS query happens only the first time of being disconnected from the VPN, for another occurrence the WiFi connection has to be reestablished. I can't say if the problem is only related to the Mullvad app or if playing around with different options caused the current state (did not perform a factory reset by now).
System settings
Developer options: never enabled
User: Owner (never another created)
Enabled: Always-on VPN
Enabled: Block connections without VPN
Off: Private DNS
Vanadium
Off: Use secure DNS (in case that would matter)
Mullvad VPN app
Disabled: Local network sharing
Enabled: DNS content blockers (thereby not using the below custom DNS server option)
Enabled: In-tunnel IPv6
Automatic: Device IP version
Disabled: Split tunneling