[somidscr21]

I've found that using my v4 only network from my ISP and macOS can do v6 only without requiring a DNS server like you have been doing. I don't remember the details now, but after some digging a few years ago I realized macOS will happily work like that as long as it has a v6 address. I can put a ULA address on my host, and it's good to go. Granted this relies on users knowing how to do that. or depending on the VPN application to get to the v6 only network, you may be able to script adding a ULA (any kind even made up). You don't want to leave it wIth a made up ULA because that could screw things up if the user moves to a v6 capable network.

[avhception]

Interesting. Do you actually use that trick in production? I'd have to find a name of an interface that I could safely mess with...

[somidscr21]

Yeah I've been using it daily for almost a year as have many other people at work

[avhception]

In an automated fashion using some kind of "PostUp" Script (to use the Wireguard term) or do you add the IPs manually after the VPN has been established?

[somidscr21]

I was able to write an AppleScript that ran on connection to add a dummy ULA and a disconnect script that undid it and went back to auto v6.