diff --git a/etc/resolv.conf b/etc/resolv.conf
index fc304133..630116ff 100644
--- a/etc/resolv.conf
+++ b/etc/resolv.conf
@@ -12,10 +12,12 @@
 nameserver ::1
 nameserver 127.0.0.1
 
-# systemd-resolved
+# systemd-resolved. WARNING: May cause DNS leaks.
 nameserver 127.0.0.53
 
-# randomly utilize both, extended DNS, trust DNSSEC from both
+# rotate = randomly use all
+# edns0 = extended DNS
+# trust-ad DNSSEC answers
 options rotate edns0 trust-ad
 
 # no sending local domain to upstream whenever NXDOMAIN happens