Bare in mind systemd’s resolved has dnssec validation disabled by default and it’s (afaik) still marked as experimental.