{ config, ... }: {
  networking.nameservers = [
    "2606:4700:4700::1111#one.one.one.one"
    "2606:4700:4700::1001#one.one.one.one"
    "1.1.1.1#one.one.one.one" 
    "1.0.0.1#one.one.one.one" 
  ];
  services.resolved = {
    enable = true;
    dnssec = "true";
    domains = [ "~." ];
    fallbackDns = config.networking.nameservers;
    extraConfig = ''
      DNSOverTLS=yes
    '';
  };
}
