Or if you bind kresd/unbound to an ip, like I do, instead of letting them listening globally.
option dns in /etc/config/network gets propagated to /tmp/resolv.conf.auto. That file is used as a source for local DNS resolver. Any local query is then according to /etc/resolv.conf sent to local DNS resolver and if such resolver has forwarding enabled then it forwards this request to provided name server