[mnordhoff]

This has a couple bugs:

1.1.1.2 and 1.1.1.3 both return the SVCB records for 1.1.1.1. (I don't know if clients would ignore them, or actually switch to 1.1.1.1.)

Non-SVCB-type queries for _dns.resolver.arpa return NXDOMAIN instead of NOERROR. (This probably doesn't have significant impact, but might break it for some clients, e.g. if they can be tricked into making queries for _dns.resolver.arpa, or if a downstream resolver makes DS queries.)

[majke]

Thanks!