I eventually figured that out thankfully. Security by default is more work, but way more peace of mind this way. I heard they are also working on ad blocking, which will be nice
check out https://nextdns.io/ you get a 7 day trial w/o even signing up. it's free for 300,000 querries per month so i recommend using an alias email over vpn or tor to sign up. once you get your link, on grapheneos: 1. Go to Settings → Network & internet → Private DNS. 2. Select the Private DNS provider hostname option. 3. Enter (yournumber).dns.nextdns.io and hit Save.