# /etc/systemd/resolved.conf.d/ipa.conf
[Resolve]
DNS=127.0.0.1
Domains=~.

import os
from ipaplatform.paths import paths

def detect_resolve1_resolv_conf():
    """Detect if /etc/resolv.conf is managed by systemd-resolved

    See man(5) NetworkManager.conf
    """
    systemd_resolv_conf = {
        "/run/systemd/resolve/stub-resolv.conf",
        "/run/systemd/resolve/resolv.conf",
        "/lib/systemd/resolv.conf",
        "/usr/lib/systemd/resolv.conf",
    }
    try:
        dest = os.readlink(paths.RESOLV_CONF)
    except OSError:
        # not a link
        return False
    # convert path relative to /etc/resolv.conf to abs path
    dest = os.path.normpath(
        os.path.join(os.path.dirname(paths.RESOLV_CONF), dest)
    )
    return dest in systemd_resolv_conf

import socket
import dbus

DBUS_RESOLVE1_NAME = "org.freedesktop.resolve1"
DBUS_RESOLVE1_PATH = "/org/freedesktop/resolve1"
DBUS_RESOLVE1_MANAGER_IF = 'org.freedesktop.resolve1.Manager'
DBUS_PROPERTY_IF = 'org.freedesktop.DBus.Properties'
# netlink interface index for resolve1 global settings and loopback
IFINDEX_GLOBAL = 0
IFINDEX_LOOPBACK = 1

def get_resolve1_nameservers():
    """Get list of DNS forwarders from systemd-resolved

    :return: list of tuples (ifindex, ipaddress)
    """
    bus = dbus.SystemBus()
    try:
        resolve1 = bus.get_object(DBUS_RESOLVE1_NAME, DBUS_RESOLVE1_PATH)
        prop_if = dbus.Interface(resolve1, DBUS_PROPERTY_IF)
        dns_prop = prop_if.Get(DBUS_RESOLVE1_MANAGER_IF, "DNSEx")
    finally:
        bus.close()
    results = []
    for ifindex, af, dns_arr, port, sniname in dns_prop:
        if af not in {socket.AF_INET, socket.AF_INET6}:
            # neither IPv4 nor IPv6
            continue
        if port not in {0, 53} or sniname:
            # non-default port, non-standard port, or SNI name configuration
            # for DNS over TLS, e.g. 1.2.3.4:9953#example.com
            continue
        # netlink interface index, see socket.if_nameindex()
        ifindex = int(ifindex)
        dnsip = socket.inet_ntop(af, bytes(dns_arr))
        results.append((ifindex, dnsip))
    return results

....
     results.append((ifindex, socket.if_indextoname(ifindex), dnsip))

$ git diff
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index aae2fe603..3b446ce76 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -1121,18 +1121,18 @@ class BindInstance(service.Service):

     def setup_resolv_conf(self):
         searchdomains = [self.domain]
-        nameservers = []
+        nameservers = set()
         resolve1_enabled = dnsforwarders.detect_resolve1_resolv_conf()

         for ip_address in self.ip_addresses:
             if ip_address.version == 4:
-                nameservers.append("127.0.0.1")
+                nameservers.add("127.0.0.1")
             elif ip_address.version == 6:
-                nameservers.append("::1")
+                nameservers.add("::1")

         try:
             tasks.configure_dns_resolver(
-                nameservers, searchdomains,
+                sorted(nameservers), searchdomains,
                 resolve1_enabled=resolve1_enabled, fstore=self.fstore
             )
         except IOError as e:
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index d1d8b3a64..ef58fd24c 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -1437,8 +1437,9 @@ def upgrade_bind(fstore):
     # resolve1's stub resolver config file.
     has_resolved_ipa_conf = os.path.isfile(paths.SYSTEMD_RESOLVED_IPA_CONF)
     if not has_resolved_ipa_conf and detect_resolve1_resolv_conf():
-        ip_addresses = installutils.get_server_ip_address(
-            api.env.host, True, False, [])
+        ip_addresses = installutils.resolve_ip_addresses_nss(
+            api.env.host
+        )
         bind.ip_addresses = ip_addresses
         bind.setup_resolv_conf()
         logger.info("Updated systemd-resolved configuration")