@grauwolf systemd-resolved was actually surprisingly usable/configurable and offers a few "real world" features that other solutions don't (such as proper fallback DNS servers).

The one thing that's bothersome is that it suffers from the opinionated decisions that plague systemd in general: Odd behaviour that cannot be changed, such as the fact that it *always* strips the AD-bit from replies. The only way to get authenticated replies from resolved is to let resolved itself do DNSSEC validation, which is a complete waste of resources if you have a trusted resolver configured anyway.

Another weird corner case is docker, which tries to detect resolved and do some "smart" nonstandard behaviour that kinda defeats the entire purpose of having a local caching resolver. Then again, it's docker we're talking about...