This is an issue that we actually discussed with folks over Netifyd, and the quick response is: it seems that it doesn’t work properly. Some adjustments are being made with next netifyd release, but they are a work in progress on our end.
A solution is to enable ThreatShield DNS and enable doh_vpn_tor_proxy list, that should cover all basic cases.