Leaving this here since we are interested in neutering any non-Tor DNS resolution
The systemd-resolve tool has been renamed to resolvectl (it also remains available under the old name, for compatibility), and its interface is now verb-based, similar in style to the other ctl tools, such as systemctl or loginctl.
The resolvectl/systemd-resolve tool also provides ‘resolvconf’ compatibility. It may be symlinked under the ‘resolvconf’ name, in which case it will take arguments and input compatible with the Debian and FreeBSD resolvconf tool.