I do not think a full local resolver is necessary. E.g. stubby [0] can be set up to use a remote resolver via DNS over TLS (simpler than DoH, less of a hack, al

I do not think a full local resolver is necessary. E.g. stubby [0] can be set up to use a remote resolver via DNS over TLS (simpler than DoH, less of a hack, all the same crypto guarantees). That remote resolver can be CloudFlare, Quad 9/101, or self-hosted unbound instance. Then only the remote resolver has to worry about caching and DNSSEC, etc. [0] https://github.com/getdnsapi/stubby/blob/develop/README.md https://github.com/getdnsapi/stubby/blob/develop/README.md