diff --git a/modules/linux/dns.nix b/modules/linux/dns.nix
index d900e1f..deb39ec 100644
--- a/modules/linux/dns.nix
+++ b/modules/linux/dns.nix
@@ -1,14 +1,13 @@
 { config, lib, ... }: let
-  inherit (lib) mkIf concatStringsSep;
+  inherit (lib) mkIf;
 in {
   services.resolved = mkIf (!config.isServer) {
     enable = true;
 
-    extraConfig = config.dnsServers
-      |> map (server: "DNS=${server}")
-      |> concatStringsSep "\n";
-
-    dnssec     = "true";
-    dnsovertls = "true";
+    settings.Resolve = {
+      DNS = config.dnsServers;
+      DNSSEC = true;
+      DNSOverTLS = true;
+    };
   };
 }