It doesn’t work with private DNS servers or forward DNS over VPN.

Like, you want to have it query some particular DNS server?

From man 5 resolved.conf:

   DNS=
       A space-separated list of IPv4 and IPv6 addresses to
       use as system DNS servers. 

       For compatibility reasons, if
       this setting is not specified, the DNS servers listed
       in /etc/resolv.conf are used instead, if that file
       exists and any servers are configured in it.

If you specify your private server there, it should work. For VPN, I mean, whatever VPN software you're using will need to plonk it in there. Maybe yours is not aware of systemd-resolved, is modifying /etc/resolv.conf after systemd-resolved has already started, and it doesn't watch it for updates?

In my /etc/nsswitch.conf, I have:

hosts:          files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

I'm assuming that the "resolve" entry is for systemd-resolved.

kagis

https://www.procustodibus.com/blog/2022/03/wireguard-dns-config-for-systemd/

With systemd-resolved, however, instead of using that DNS setting, add the following PostUp command to the [Interface] section of your WireGuard config file:

PostUp = resolvectl dns %i 9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net; resolvectl domain %i ~.

When you start your WireGuard interface up, this command will direct systemd-resolved to use the DNS server at 9.9.9.9 (or at 149.112.112.112, if 9.9.9.9 is not available) to resolve queries for any domain name.