A couple minor comment/log text nits
Default PR_SET_NO_NEW_PRIVS on Linux 3.5+

Can be disabled if necessary via new config option:
'weaker_security => true'
Add recommend sec/oomkill stuff to gdnsd.service