This is also what we're trying to do in Tailscale (to grab your MagicDNS domain, and whatever corporate split DNS you set, but not anything else). And yeah, on

This is also what we're trying to do in Tailscale (to grab your MagicDNS domain, and whatever corporate split DNS you set, but not anything else). And yeah, on linux, basically systemd-resolved is the only thing that gets this right (with dynamic config - with fully static config, other recursors are an option, with varying tradeoffs), everything else assumes "one resolver should be enough for everything". So, your solution to proxy all the traffic and split out as needed is the right way to do it without adding more software into each VM :( Doing stuff via LD_PRELOAD would be hilarious, you should definitely do that and report back ducks behind the blast shield