I used to think that setting Private DNS server in "Network & Internet" settings only altered DNS settings for non-VPN connections if VPN app settings specified different DNS servers, but I was wrong. Vanadium (with Secure DNS disabled) results from browserleaks.com show that Private DNS server overrides whichever settings are set in NordVPN app. Is that by design or is that a GrapheneOS feature? Does the same apply to other apps from other VPN providers and apps like OpenVPN for Android?
It would be nice to have a toggle to force Private DNS settings to apply only to non-VPN interfaces and have VPN apps control DNS resolution inside VPN tunnels.