Re: This is bad, was Re: Fedora 33 System-Wide Change proposal: systemd-resolved

[Florian Weimer]

* Michael Catanzaro:
> If you're running mail servers or VPN servers, you can probably
> configure the DNS to your liking, right? Either enable DNSSEC support 
> in systemd-resolved, or disable systemd-resolved. I'm not too
> concerned about this....

What about end users who just enable a VPN client?

My understanding is that the DNS request routing in systemd-resolved
effectively disables any security mechanisms on the VPN side, and
instructs most current browsers to route DNS requests to centralized DNS
servers for all requests (i.e., overriding what came from both the VPN
and DHCP).

Thanks,
Florian