They should consider using dnstrigger and a local dnssec validating resolver by default like fedora