DNS fails when 'Use this connection only for resources on its network' is checked

Question

It seems I can only have DNS or Routing working. Not both.

I imported my client's ovpn file and when I connect (with the defaults) I can access resources behind their firewall, their DNS servers take over, and all is good. Only problem: I can't access anything that's not on their server:

• host onvpn.com 123.45.67.89
• host npr.org 216.35.221.76
• ping 123.45.67.89 SUCCEEDS
• ping 216.35.221.76 FAILS

When I check off 'Use this connection only for resources on its network' I can still ping ips behind their server, but DNS on the server dies:

• host onvpn.com NOT FOUND
• host npr.org 216.35.221.76
• ping 123.45.67.89 SUCCEEDS
• ping 216.35.221.76 SUCCEEDS

If I uncheck Automatic for DNS (while still leaving "only resources on its network" checked off), and manually enter the addresses for the DNS servers I'm supposed to be using I get the same results.

Can I really only get Routing or DNS, pick one?

I'm on Zesty. I am using the network-manager-openvpn-gnome package to manage the connection. It works fine on my windows machine and Mac (with TunnelBlick) using default settings from the ovpn file.

== EDIT ==

I've run systemd-resolve --status in both states and it looks identical except a tilde in front of the domain when I have "Use this connection..." checked. I'm not sure how else to debug. I really don't want to use Windows or manually editing my hosts file...there's a lot of machines behind the VPN...