Hm, looks like unwind just falls back to letting the local recursive resolver spy on you in case port 53 is blocked, though? I guess it + local recursive resolv

Hm, looks like unwind just falls back to letting the local recursive resolver spy on you in case port 53 is blocked, though? I guess it + local recursive resolver between them might have bit of a cache - but the browser could also cache dns more aggressively (not that I think that'd be a good idea). Not saying it's bad to run unwind, just that if the scenario is that the router blocks access to root servers, and the local resolver spys on you - it (alone) won't help? And with a spying local resolver, I'd assume the router logs plain text udp traffic anyway... https://man.openbsd.org/unwind.8 https://man.openbsd.org/unwind.8