{ config, lib, ... }: let
  inherit (lib) mkIf;
in {
  services.resolved = mkIf (!config.isServer) {
    enable = true;

    settings.Resolve = {
      DNS = config.dnsServers;
      DNSSEC = "allow-downgrade";
      DNSOverTLS = "opportunistic";
    };
  };
}