{...}: {
    services = {
        resolved = {
            enable = true;
            dnsovertls = "true";
            dnssec = "true";
            llmnr = "resolve";
            domains = [
                "~."
            ];

            fallbackDns = [
                # cf dns
                "1.1.1.1"
                "1.0.0.1"
                "2606:4700:4700::1111"
                "2606:4700:4700::1001"

                # google dns
                "8.8.8.8"
                "8.8.4.4"
                "2001:4860:4860::8888"
                "2001:4860:4860::8844"

                # q9 dns
                "9.9.9.9"
                "149.112.112.112"
                "2620:fe::fe"
                "2620:fe::9"

                # open dns
                "208.67.222.222"
                "208.67.220.220"
                "2620:119:35::35"
                "2620:119:53::53"
            ];
        };
    };
}