@@ -8,7 +8,6 @@ let
   wan = config.networking.nat.externalInterface;
   lans = config.networking.nat.internalInterfaces;
   lan = builtins.head lans;
-  tailnet = "fin-marlin.ts.net";
 
   inherit (config.networking) domain hostName;
 
@@ -21,14 +20,39 @@ deviceAddr = "192.168.100.1";
     ourAddr = "192.168.100.10";
   };
 
-  nameservers = [
-    "2620:fe::fe"
-    "2620:fe::9"
-    "9.9.9.9"
-    "149.112.112.112"
-  ];
-  nsTLSHostname = "dns.quad9.net";
+  dnsProviders = {
+    quad9 = {
+      hostname = "dns.quad9.net";
+      addresses = [
+        "2620:fe::fe"
+        "2620:fe::9"
+        "9.9.9.9"
+        "149.112.112.112"
+      ];
+    };
+    dnssb = {
+      hostname = "dot.sb";
+      addresses = [
+        "2a09::"
+        "2a11::"
+        "45.11.45.11"
+        "185.222.222.222"
+      ];
+    };
+  };
+
+  allProviders = lib.attrValues dnsProviders;
+  mainProvider = dnsProviders.quad9;
+
   justAddress = (a: builtins.head (lib.strings.splitString "/" a));
+  myAddresses = map justAddress config.systemd.network.networks."40-${lan}".address;
+  isv6 = (lib.strings.hasInfix ":");
+  wrapv6 =
+    addr:
+    if isv6 addr then
+      if lib.hasPrefix "[" addr && lib.hasSuffix "]" addr then addr else "[" + addr + "]"
+    else
+      addr;
 in
 {
   imports = [
@@ -116,7 +140,8 @@ ConfigureWithoutCarrier = true;
           MulticastDNS = true;
           Domains = [ config.networking.domain ];
           LinkLocalAddressing = "ipv6"; # required for networkd RA despite fe80::1 static assignment
-          DNS = map justAddress address;
+          DNSOverTLS = false;
+          DNS = map (a: "${wrapv6 a}:${toString config.services.dnsmasq.settings.port}") myAddresses;
           DNSDefaultRoute = false;
           IPv6SendRA = true;
         };
@@ -149,7 +174,7 @@ IPv4Forwarding = true;
           MulticastDNS = false;
           DNSDefaultRoute = true;
           DNSOverTLS = true;
-          DNS = "::1";
+          DNS = map (p: map (ns: "${ns}#${p.hostname}") p.addresses) allProviders;
         };
         dhcpV4Config = {
           UseDNS = false;
@@ -206,17 +231,17 @@ services.adguardhome.settings =
     let
       dnsmasq = "[::1]:${toString config.services.dnsmasq.settings.port}";
       resolved = builtins.head config.services.resolved.settings.Resolve.DNSStubListenerExtra;
+      mkTLSHost = p: "tls://${p.hostname}";
     in
     {
       dns = {
-        upstream_dns = [
-          "tls://${nsTLSHostname}"
+        upstream_dns = (map mkTLSHost allProviders) ++ [
           # [/domain1/domain2/domainN/]upstreamString
           "[/${domain}/]${dnsmasq}"
           # [//]: unqualified only
           "[//]${resolved}"
         ];
-        bootstrap_dns = nameservers;
+        bootstrap_dns = mainProvider.addresses;
         bootstrap_prefer_ipv6 = true;
 
         use_private_ptr_resolvers = true;
@@ -228,22 +253,16 @@ services.resolved = {
     enable = true;
     settings.Resolve = {
       DNS = [ "" ];
-      FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
+      FallbackDNS = map (p: map (ns: "${ns}#${p.hostname}") p.addresses) allProviders;
       LLMNR = false;
       MulticastDNS = true;
-      DNSOverTLS = "opportunistic";
+      DNSOverTLS = true;
       DNSStubListener = false;
-      DNSStubListenerExtra = [ "[::1]:90" ];
     };
   };
   networking.resolvconf.enable = false;
 
   services.tailscale.extraSetFlags = [ "--accept-dns=false" ];
-  environment.etc."resolv.conf".text = lib.mkForce ''
-    nameserver ::1
-    search ${domain} ${tailnet}
-    options edns0 trust-ad
-  '';
 
   boot.kernelModules = [
     "tcp_lp"