<snip/>
Oh, I guess I have an idea what's happening. systemd-resolve triggers the start via D-Bus activation.
Yeah, that was my guess as well. Just seemed wrong to me given that the unit providing that service is masked.
/usr/share/dbus-1/system-services/org.freedesktop.resolve1.service
For the record, masking org.freedesktop.resolve1.service didn't help.
has SystemdService=dbus-org.freedesktop.resolve1.service dbus-org.freedesktop.resolve1.service is a symlink to systemd-resolved.service So, you'll also need to mask that name, i.e dbus-org.freedesktop.resolve1.service
But masking that one did. # systemd-resolve debian.org debian.org: resolve call failed: Unit dbus-org.freedesktop.resolve1.service is masked. Thanks, Brian