> "a pretty complete caching DNS and LLMNR stub resolver" That quote is gold. Most of DNS isn't implementing the protocol, but implementing all the protection

> "a pretty complete caching DNS and LLMNR stub resolver" That quote is gold. Most of DNS isn't implementing the protocol, but implementing all the protections against cache poisoning, many of which are not intuitive. But as the oss-sec email says: "systemd-resolved does not implement any of the hardening recommendations of rfc5452."