Cannot install DNS over HTTPS (DoH) profile - "VPN Service could not be created" error

I'm trying to install a DNS over HTTPS configuration profile on macOS 26.1 (Tahoe), but I receive the following error:

  "The 'VPN Service' payload could not be installed. The VPN service could not be created."

  The profile contains:

  - DNS Settings payload (com.apple.dnsSettings.managed) for DoH

  - Application restrictions payload

  - Chrome managed settings payload

  The profile passes plutil -lint validation and is properly formatted. There is no actual VPN payload in the profile - only DNS Settings.

  What I've tried:

  - Double-clicking the profile to install via System Settings

  - Using profiles install command in Terminal

  - Verified the XML structure is correct

  My questions:

  1. Is this a known limitation in macOS 26.1(and 26.2) where DNS Settings profiles require MDM enrollment?

  2. Is there a way to install DoH profiles on non-MDM-managed Macs?

  3. Why does the error reference "VPN Service" when the profile only contains DNS Settings?

  Any guidance on how to configure custom DoH on recent macOS versions would be appreciated.