[dns-operations] On-board resolvers (was Re: NANOG threat on government-ordered DNS poisoning and DNSSEC.)

[Florian Weimer]

* Marek Vavruša:

> Note: systemd-resolved is still a stub (but caching at least).

And the cache is not very well-implemented and will sometimes go
wrong.  This can happen if a recursive resolvers does not implement an
application layer gateway (like BIND 9) and passes through some
upstream answers unchanged.