Link-local multicast name resolution (LLMNR) is a deprecated mDNS-like Microsoft protocol used in Windows that is being phased out. systemd-resolved resolves LLMNR names by default, but the service allows spoofed responses and is trivial to poison.

There's an upstream PR to disable it by default that hasn't seen much action, so it might make sense to do it here. It probably isn't worth a ujust toggle given how rarely it's used.

Old behaviour:

$ resolvectl status
[...] Link 2 (enp1s0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
         Protocols: +DefaultRoute LLMNR=resolve -mDNS +DNSOverTLS DNSSEC=yes/supported

New behaviour:

$ resolvectl status
[...] Link 2 (enp1s0)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported