Do you think VPN doesn’t necessarily prevent MITM anywhere between you and VPN server? Regarding DNS queries, here is a quote I found: “Full-Tunnel VPN routes and encrypts all the Internet traffic through the VPN. Consequently, DNS requests are also encrypted and out of the control of the Internet provider". I’m not sure how to setup VPN in a way that doesn’t tunnel DNS requests through VPN server because I mostly use smart clients like Proton’s one that route everything and have total killswitch.