I have a single pptp VPN configured (to access the M$ work network),
from which routes are ignored (routes dialog 'Ignore automatically
obtained routes' ticked, 'Use this connection only for resources on its
network' ticked) and supposedly DNS servers are ignored (IPv4 Settings
tab, method 'Automatic (VPN) addresses only'). Basically I just want to
connect directly to my workstation via IP address which works fine.

When I connect to the VPN, Network Manager inserts the VPN DNS servers
at the top of '/etc/resolv.conf' (what is the setting to stop this?) and
removes the correct local one, and then most times on disconnect (at
least when disconnecting via the systray tool), Network Manager does not
clean up after itself and leaves the invalid nameservers in place
without restoring the correct one, resulting in most networking
operations being completely broken. For reference it manages the normal
connection.

Initially I had the version in testing (v1.0.2-2), but upgraded to
v1.0.4-1 to see if it made a difference (it didn't).

With my original problem, the normal DNS server remained but so did the
work ones on top resulting in strange DNS lookup delays - so with
today's testing removing the correct nameserver too, Network Manager is
screwing things up even more.
Debian Release: stretch/sid
  990 testing         www.deb-multimedia.org
  990 testing         10.1.0.3
  500 unstable        10.1.0.3
  500 quodlibet-unstable 10.1.0.3
    1 experimental    10.1.0.3
--- Package information. ---
Depends                         (Version) | Installed
=========================================-+-================
libc6                           (>= 2.17) |
libdbus-1-3                    (>= 1.0.2) |
libdbus-glib-1-2               (>= 0.102) |
libgcrypt11                    (>= 1.4.5) |
libglib2.0-0                  (>= 2.37.3) |
libgnutls-deb0-28           (>= 3.2.10-0) |
libgudev-1.0-0                   (>= 165) |
libmm-glib0                    (>= 1.0.0) |
libndp0                          (>= 1.2) |
libnewt0.52                               |
libnl-3-200                   (>= 3.2.21) |
libnl-genl-3-200              (>= 3.2.21) |
libnl-route-3-200              (>= 3.2.7) |
libnm-glib4                 (>= 0.9.10.0) |
libnm-util2                 (>= 0.9.10.0) |
libpolkit-gobject-1-0          (>= 0.101) |
libreadline6                     (>= 6.0) |
libsoup2.4-1                  (>= 2.39.3) |
libsystemd-daemon0                (>= 31) |
libsystemd-login0                 (>= 31) |
libuuid1                        (>= 2.16) |
init-system-helpers            (>= 1.18~) |
lsb-base                      (>= 3.2-14) |
wpasupplicant                (>= 0.7.3-1) |
dbus                           (>= 1.1.2) |
udev                                      |
adduser                                   |
isc-dhcp-client           (>= 4.1.1-P1-4) |
libpam-systemd                            |
policykit-1                               |


Recommends        (Version) | Installed
===========================-+-===========
ppp              (>= 2.4.6) | 2.4.6-3.1
dnsmasq-base                | 2.73-2
iptables                    | 1.4.21-2+b1
modemmanager                | 1.4.10-1
crda                        | 3.13-1


Suggests           (Version) | Installed
============================-+-===========
avahi-autoipd                |

I have played around with this some more - the idea with the work VPN
connection is not that it takes over everything, but simply that one
particular IP address gets routed to it - everything else works as normal.

This is why I'm ignoring routes etc, with 'Automatic (VPN) addresses
only' used with the intention of not fiddling with the current DNS
configuration, which is failing.

The workaround is to manually set 'DNS servers' and 'Search domains' to
the normal values outside of the VPN, rather than leaving them blank,
which Network Manager can't seem to cope with.