nix-dotfiles/modules/nixos/basics/resolved.nix

{
  services.resolved = {
    enable = true;
    dnssec = "true";
    # dnsovertls = "true";
    fallbackDns = [
      "1.1.1.1"
      "8.8.8.8"
    ];
  };
}