Regardless, the fallback is always your own DNS, which invariably is your Internet provider's DNS, by default.
Even if it is your own DNS provider, you do not encrypt the DNS request, by default.
There are ways to do this “just right,” but you have to be quite careful.
If Brazil's government is told by your Internet provider you requested “twitter.com” to get resolved to an IP address—you are getting a door knock. After they get your devices, they will see you accessed Twitter through a VPN.
I set mine DNS to 8.8.8.8