by default it blocks queries to private zones, can be extended to match anything in the query content (i.e. water torture style attacks)

before root hints were hardcoded to the resolver,
now they are present in form of a cut in the resolution
context, and the modules can add/remove/replace them
on the fly

the Redis backend supports UNIX, TCP and custom ports
no real transactions nor iteration, but it’s not needed at the moment
transactions keep replies in a freelist, which is purged on transaction
commit / abort

fixes potential cache key oob write

this relies on a lot of things (intrinsic), frame pointer and symbol dynamic symbol table