Use DNSSEC resolver (requires net-dns/unbound