Thanks for your answer

My company provides me with a device and a sim card, but the data plan only allows specific traffic from select work apps. I don’t need nextdns for this traffic, and having NextDNS on with cellular data completely blocks all traffic. I therefore have to keep switching Nextdns on and off when going from wifi to 4g, which is unpractical. 

It seems however that using the apple profile with the company domain excluded, might bypass some protection and allow cellular traffic. I only just discovered that, so I have to do some further testing. 

I suppose that the company also uses some kind of DNS protection to block all but sélect traffic when using 4G, which conflicts with nextdns

Excluding the company domain does seem to work, however it creates another problem for my use case. When using wifi I connect through WireGuard, and I need to leave the DNS settings in WG empty for nextdns to work. Which means that I cannot resolve my company domains when using wifi, since they’re excluded but have no alternative DNS server.. so back to square one and having to switch something on and off when going from 4g to wifi..