{lib, ...}: {
  networking.nameservers = [
    # https://dnsforge.de/
    "176.9.93.198"
    "176.9.1.117"

    # TODO: enable IPv6
    # "2a01:4f8:151:34aa::198"
    # "2a01:4f8:141:316d::117"
  ];

  services.resolved = {
    enable = true;
    dnssec = "true";
    domains = ["~."];

    # TODO: figure out why "true" doesn't work
    dnsovertls = "opportunistic";

    fallbackDns = lib.mkForce [];
  };
}