musl asks every nameserver at once and takes the first reply, so a public resolver's NXDOMAIN for a mesh name beat the mesh's answer in every Alpine container (hq ADR 0223). resolv-conf now renders /etc/resolv.conf from the holders of mesh-dns-resolver, this machine first when it holds one; dnsmasq's comments say the seat may have several holders.