As a workaround, I commented out dns=dnsmasq in /etc/NetworkManager/NetworkManager.conf.
Now network manager adds VPN DNS servers to /etc/resolv.conf and everything works as expected.
As an additional benefit, it also adds and uses additional search domains but only with "Use this connection only for resources on its network" unchecked, so all traffic is routed to the tunnel.
With working DNS I can live with it for now.
As a workaround, I commented out dns=dnsmasq in /etc/NetworkMan ager/NetworkMan ager.conf.
Now network manager adds VPN DNS servers to /etc/resolv.conf and everything works as expected.
As an additional benefit, it also adds and uses additional search domains but only with "Use this connection only for resources on its network" unchecked, so all traffic is routed to the tunnel.
With working DNS I can live with it for now.
I'm on Mint 18.3 Cinnamon.