It's about time to question the whole off-host DNS resolver thing entirely. Fine if you want to have a cache, but the cache should return the whole record chain starting from the root in that case, so the client can validate it. Also fine to have an on-host cache that caches validation status.