The DNS issue is worth in systemd's resolver because it is NOT merely a "stub resolver" - it implements a cache. From the same thread: "The DNS specification d

The DNS issue is worth in systemd's resolver because it is NOT merely a "stub resolver" - it implements a cache. From the same thread: "The DNS specification does not require rewriting of upstream responses to filter out parts for which the queried server is not authoritative. This means that a downstream caching resolver will tend to poison its cache if it adds data from such responses that are not directly in response to the QNAME." http://seclists.org/oss-sec/2014/q4/602 http://seclists.org/oss-sec/2014/q4/602 Adding entries (including additional records, which are common in DNS) without validation is just asking for a DNS poisoning attack.