Fully optional — only reached when the resource DNS resolver is enabled in Settings. Public or admin-configured recursive resolver(s) (default 1.1.1.1 / 8.8.8.8, Settings.dnsResolverUpstream) the hub forwards any query outside its own managed resource zone to, verbatim and unparsed (ADR-0023).