In addition to what you wrote, I'd add from my own experience: - never trust a single DNS server as a source of truth - always rely on transport encryption, w

In addition to what you wrote, I'd add from my own experience: - never trust a single DNS server as a source of truth - always rely on transport encryption, which DNS on port 53 (via UDP) does not offer - verify your results statistically, rotate servers (DNS ronin), and endpoint protocols in order to verify there's no MITM - deactivate message compression if possible. Naive implementations are vulnerable to both stack and buffer overflows (see NAMEWRECK). - don't rely on DNS cookies, and always assume there can be multiple records with different types in a reply to a single question. - DNS TTL 0 is a fix for stupidity, and nothing else. If any of the above isn't respected it's your fault as a DNS client, because the protocol was designed when the internet was a nice place and everybody literally knew everybody via the /etc/hosts file dumps. That's why I'm a strong believer in DNS via HTTPS, because having a better and more reliable transport protocol would fix a lot of the issues people/clients have to face. DNS via TLS turned out to be useless because the dedicated port 853 for it literally gets blocked by ISPs and nobody can do shit about it.