Sorry, i can't help you with networkmanager related stuff. One approach to debug the issue would be searching in logs and with systemd tools to find differences between the situation with working and not working dns resolution. The various dnscrypt-proxy log files might be useful, status of involved systemd units, custom configurations changes, ... Does this only happen with dnscrypt-proxy and not with other local resolvers? If the network is up, dnscrypt-proxy receives a query but can't resolve it, i thought it should be possible to see this in its logs. Is the attached file the complete configuration? The default openSUSE one looks differently. For example it offers more logging options that can be used to debug but are missing here.