systemd-resolved DNS-over-TLS: Detecting Silent Downgrade in Opportunistic Mode

Goal

Determine whether systemd-resolved silently falls back from DNS-over-TLS to plain DNS when a certificate fails validation while operating in opportunistic mode.

Constraints

In opportunistic mode, a TLS handshake or certificate validation error produces the same observable result as a resolver that never offers DoT, so the host never sees a visible error and confidentiality is lost.

Unresolved Questions

• How can we programmatically distinguish a plaintext query that was retried after a DoT failure from a query sent to a resolver that offers no DoT?
• What logging or monitoring hooks in systemd‑resolved expose certificate validation failures versus lack of DoT support?
• When per‑link DnsOverTLS= settings differ from the global DNSOverTLS= value, how can we guarantee consistent DoT behavior across all configured resolvers?