If a NS record is present and the gateway is authoritative it can skip a full query to the DHT. https://did-dht.com/#designating-authoritative-gateways Similarly, we can decode DNS packets and reject records that are not DIDs.