@nprofile1q... Each profile has separate VPN configuration rather than it being global. There are VPN service apps which provide support for DoT/DoH/DoQ without an actual VPN. VPN apps don't have to provide an actual VPN and have the ability to replace the system DNS without routing other traffic through themselves. VPN apps can do things like local filtering/monitoring of traffic with or without routing traffic through a VPN, where RethinkDNS is one example of that.