This is perhaps a regression of bug #493678 as the current network-manager in Ubuntu 17.04 has moved to systemd-resolved.

In previous versions, when the DHCP parameter DOMAIN was provided, it automatically became a search domain. Some reports on on the internet claim that the DOMAIN-SEARCH needed to be specified by the server, though that was not my experience. In either case, it was possible to set the search domain.

With the current version, it is not set.

The server sends it (from journalctl):

May 23 22:41:42 pat-desktop NetworkManager[1286]: <info>  [1495593702.2415] vpn-connection[0x558edf074300,4c08cf1f-4c43-4ae1-b6ef-b78362e14f48,"FooTest",11:(tun0)]: Data:   Static Route: 172.16.0.0/24   Next Hop: 10.1.1.5
May 23 22:41:42 pat-desktop NetworkManager[1286]: <info>  [1495593702.2415] vpn-connection[0x558edf074300,4c08cf1f-4c43-4ae1-b6ef-b78362e14f48,"FooTest",11:(tun0)]: Data:   Forbid Default Route: yes
May 23 22:41:42 pat-desktop NetworkManager[1286]: <info>  [1495593702.2415] vpn-connection[0x558edf074300,4c08cf1f-4c43-4ae1-b6ef-b78362e14f48,"FooTest",11:(tun0)]: Data:   Internal DNS: 172.16.0.1
May 23 22:41:42 pat-desktop NetworkManager[1286]: <info>  [1495593702.2415] vpn-connection[0x558edf074300,4c08cf1f-4c43-4ae1-b6ef-b78362e14f48,"FooTest",11:(tun0)]: Data:   DNS Domain: 'foo.ca'

But the DNS settings as known by systemd-resolve --status:

Link 11 (tun0)
      Current Scopes: DNS
       LLMNR setting: yes
MulticastDNS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 172.16.0.1
          DNS Domain: ~foo.ca

According to their documentation (https://www.freedesktop.org/software/systemd/man/systemd.network.html):

'Each item in the list should be a domain name, optionally prefixed with a tilde ("~"). The domains with the prefix are called "routing-only domains". The domains without the prefix are called "search domains" and are first used as search suffixes for extending single-label host names (host names containing no dots) to become fully qualified domain names (FQDNs).'

It would seem something needs to set it without the tilde as appropriate.