You don't understand. The recommendation is to INSTALL and CONFIGURE a resolver service accessible via the loopback address. Whether you run a resolver locally or forward/tunnel securely to a remote trusted resolver is irrelevant.