DNSSEC validation default in systemd‑resolved on Arch Linux: an unresolved decision

Goal

Investigate whether systemd‑resolved should enable DNSSEC validation by default on Arch Linux, given the trade‑off between security and compatibility with public DNS providers.

Constraints and Uncertainty

The shipped /etc/systemd/resolved.conf sets DNSSEC=no. Enabling DNSSEC can cause resolution failures for domains served by providers that do not publish valid DNSSEC records, while disabling it leaves the system vulnerable to spoofing attacks. The Arch Wiki acknowledges this tension but does not specify a default policy.

Specific Questions

• What measurable compatibility problems arise when DNSSEC=allow-downgrade=yes is enabled across typical user workloads?
• How does the current DNSSEC=no setting affect the overall security posture compared to an enabled configuration?
• Is there a consensus among Arch maintainers to adopt a default value that balances security and reliability, and what criteria would guide that decision?