Building consensus over DNSSEC enhancements to glibc.

[Carlos O'Donell]

On 11/06/2015 04:42 AM, Petr Spacek wrote:
> The proposed AD bit stripping was an easy and cheap way to do this at one
> place in the system, with central configuration, which would allow us to
> eliminate all kinds of weird re-implementations in applications.

You have it.

Use `options dns-strip-dnssec-ad-bit` until you have NetworkManager running
with the right options and a local validating resolver.

I agree with Rich Felker. You must not allow anything to change /etc/resolv.conf
that isn't the master process (e.g. resolvconf in Ubuntu) which is in charge of
policy.

Cheers,
Carlos.