diff --git a/modules/system/devices/networking/default.nix b/modules/system/devices/networking/default.nix
index 8deebc6..6000594 100644
--- a/modules/system/devices/networking/default.nix
+++ b/modules/system/devices/networking/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 {
   imports = [
     ./wireless
@@ -11,8 +11,16 @@
     nftables.enable = true;
     firewall.allowPing = false;
     nameservers = [
-      "1.1.1.1"
-      "1.1.1.2"
+      "1.1.1.1#one.one.one.one"
+      "1.0.0.1#one.one.one.one"
     ];
   };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = config.networking.nameservers;
+    dnsovertls = "true";
+  };
 }