@@ -7,6 +7,8 @@ let
   wan = config.networking.nat.externalInterface;
   lans = config.networking.nat.internalInterfaces;
   lan = builtins.head lans;
+  tailnet = "fin-marlin.ts.net";
+
   inherit (config.networking) domain hostName;
 
   dnsmasqEnable = true;
@@ -30,7 +32,7 @@ "modem"
         "pyur"
       ];
     };
-    inherit nameservers;
+    nameservers = lib.mkForce [ "::1" ];
 
     nat = {
       enable = true;
@@ -75,6 +77,7 @@ LinkLocalAddressing = false;
           IPv6SendRA = !dnsmasqEnable;
           DHCPServer = !dnsmasqEnable;
           DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
+          DNSOverTLS = false;
           DNSDefaultRoute = false;
         };
         dhcpPrefixDelegationConfig = {
@@ -93,6 +96,7 @@ IPv4Forwarding = true;
           MulticastDNS = false;
           DNSDefaultRoute = true;
           DNSOverTLS = true;
+          DNSSEC = true;
           DNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
         };
         dhcpV4Config = {
@@ -150,11 +154,23 @@
   services.resolved = {
     enable = true;
     settings.Resolve = {
-      DNS = [ ];
+      DNS = [ "" ];
+      FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
       LLMNR = false;
       MulticastDNS = true;
+      DNSOverTLS = "opportunistic";
+      DNSStubListener = false;
+      DNSStubListenerExtra = [ "[::1]:90" ];
     };
   };
+  networking.resolvconf.enable = false;
+
+  services.tailscale.extraSetFlags = [ "--accept-dns=false" ];
+  environment.etc."resolv.conf".text = lib.mkForce ''
+    nameserver ::1
+    search home.arpa ${tailnet}
+    options edns0 trust-ad
+  '';
 
   boot.kernelModules = [
     "tcp_lp"
@@ -181,11 +197,9 @@
   services.dnsmasq = {
     enable = dnsmasqEnable;
     alwaysKeepRunning = true;
+    resolveLocalQueries = true;
     settings = {
       inherit domain;
-      interface = lan;
-      except-interface = "lo";
-      bind-interfaces = true;
       dhcp-fqdn = true;
       dhcp-authoritative = true;
       dhcp-rapid-commit = true;
@@ -199,19 +213,23 @@ quiet-dhcp6 = true;
       quiet-ra = true;
       enable-ra = true;
 
-      cache-size = 0;
+      dns-loop-detect = true;
+      stop-dns-rebind = true;
+      server = [ "::1#90" ];
+      proxy-dnssec = true;
       no-resolv = true;
-      server = [ "127.0.0.53" ];
+      cache-size = 0; # let resolved do it
 
+      localise-queries = true;
       expand-hosts = true;
-      localise-queries = true;
+      domain-needed = true;
+      local = [
+        "/${domain}/"
+      ];
       interface-name = [
         "${hostName}.${domain},${lan}"
         "wan.${domain},${wan}"
       ];
     };
   };
-  systemd.services.dnsmasq.after = [ "network-online.target" ];
-  systemd.services.dnsmasq.wants = [ "network-online.target" ];
-  systemd.network.wait-online.enable = lib.mkForce true;
 }