A link which explains bind does not return the AD (authenticated data) when it is returing AA (authoritive answer). https://groups.google.com/d/msg/comp.protocols.dns.bind/3bOLSw4cS0E/luM_wCMVokoJ
lxc / nspawn networking explained: http://containerops.org/2013/11/19/lxc-networking/
Add which resolv.conf options are needed. And only for trusted resolvers.