Comment 8 for bug 1727237

Checking for the state of the domain from outside a captive portal won't get much; "securelogin.arubanetworks.com" only exists while you're behind the captive portal, in unauthenticated mode.

I think the next steps will be to do some testing with various captive portals and see why systemd-resolved is unhappy with them. As far as I can tell from the provided answers, everything is in place (/etc/resolv.conf has the right values, systemd-resolved knows about the right nameservers, so some part of resolved is failing to send/receive the DNS messages in a meaningful way: this has all the hallmarks of a systemd-resolved bug.

The next steps for debugging this will be to stop systemd-resolved and restart it, then attempt to resolve the domain normally (via ping, for example):

sudo systemctl stop systemd-resolved
sudo SYSTEMD_LOG_LEVEL=debug /lib/systemd/systemd-resolved

ping securelogin.arubanetworks.com

And carefully look through the logs to figure out what systemd is unhappy with. I'll do this on my end as well, but if anyone can provide the same logs, that would be very helpful.