So, what exactly is the best way to mitigate this attack vector? While informative, the post only goes into detail about the attack; not a complete solution for the original intended purpose of the resolver setting.

Is the dnsmasq solution here[1] sufficient? Or, should I edit dhclient.conf to add the desired name servers[2]

[1] https://unix.stackexchange.com/questions/128220/how-do-i-set...

[2] https://unix.stackexchange.com/questions/128220/how-do-i-set...