VMs depending on a VPN ProxyVM cannot reach the DNS server

[apparatus]

The dnat-dns update works sometimes in fedora-40-xfce, but it’s unreliable.
There seems to be some problem with systemd-resolved, maybe some kind of a race condition or something else.
Restarting systemd-resolved before updating dnat-dns seems to fix the issue:

Mullvad VPN setup guide

Changing DNS multiple times in the application while connected, such as enabling the first 3 DNS filters, will cause the systemd service to crash and not change the value pulled from /etc/resolv.conf. Even if it did work properly, it’s not reliable on Fedora. Running the qubes-setup-dnat-to-ns script manually will not even update the dnat-dns chain with the correct DNS IP after a few uses. To fix this, you need to restart systemd-resolved first and then run qubes-setup-dnat-to-ns. This needs t…

So if you add:

systemctl restart systemd-resolved

Before execution of:

/usr/lib/qubes/qubes-setup-dnat-to-ns

In the /etc/NetworkManager/dispatcher.d/qubes-nmhook file then it’ll work.
No idea what’s wrong with it, I guess it’s better to create an issue on github for this.