Regarding dnsSettings profile: It "defines a configuration for an encrypted DNS server". We're not using encrypted dns.
AFAIU, The NEDNSSettingsManager has to be used with a NEPacketTunnelProvider extension. That is non trivial and goes down the route of the NEDNSProxy provider path.
Re: "you could run a local DNS server...": We're wary of replacing the system wide resolver with our own. This option is the last resort.
Is the /etc/resolver method not at all viable?