@@ -262,24 +262,38 @@ "10.0.1.10,10.0.250.250,48h"
         "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
       ];
 
-      dns-loop-detect = true;
-      stop-dns-rebind = true;
+      no-resolv = true;
       server = [ "::1#90" ];
-      proxy-dnssec = true;
-      no-resolv = true;
+      dns-loop-detect = true;
+
+      # these next few settings imply trust of the upstream resolver and the path to it
+      query-port = 0; # use single OS-allocated port: faster and more efficient
+      proxy-dnssec = true; # resolved handles dnssec and is caching
       cache-size = 0; # let resolved do it
 
+      # resolved may know about single-label names
+      # particularly those it synthesises, such as "_gateway" (see systemd-resolved(8))
+      domain-needed = false;
+      stop-dns-rebind = false; # necessary for above
+
+      # do not forward reverse lookups for private addresses, respond nxdomain
+      # (resolved will not know more than dnsmasq in such cases)
+      bogus-priv = true;
+
       quiet-ra = true;
 
+      # resolved will look there anyway
+      no-hosts = true;
+
       localise-queries = true;
-      expand-hosts = true;
-      domain-needed = true;
       local = [
         "/${domain}/"
       ];
+      local-ttl = 1; # defaults to 0 (client should not cache), but 1s shouldn't hurt
       interface-name = [
-        "${hostName}.${domain},${lan}"
-        "wan.${domain},${wan}"
+        "${hostName},${lan}" # prevents returning 127.0.0.2
+        "${hostName}.${domain},${lan}" # prevents returning 127.0.0.2
+        "wan.${domain},${wan}/6"
       ];
     };
   };