@@ -200,13 +200,27 @@ };
     };
   };
 
-  services.adguardhome.settings = {
-    dns = {
-      upstream_dns = [ "tls://${nsTLSHostname}" ];
-      bootstrap_dns = nameservers;
-      bootstrap_prefer_ipv6 = true;
+  services.adguardhome.settings =
+    let
+      dnsmasq = "[::1]:${toString config.services.dnsmasq.settings.port}";
+      resolved = builtins.head config.services.resolved.settings.Resolve.DNSStubListenerExtra;
+    in
+    {
+      dns = {
+        upstream_dns = [
+          "tls://${nsTLSHostname}"
+          # [/domain1/domain2/domainN/]upstreamString
+          "[/${domain}/]${dnsmasq}"
+          # [//]: unqualified only
+          "[//]${resolved}"
+        ];
+        bootstrap_dns = nameservers;
+        bootstrap_prefer_ipv6 = true;
+
+        use_private_ptr_resolvers = true;
+        local_ptr_upstreams = [ dnsmasq ];
+      };
     };
-  };
 
   services.resolved = {
     enable = true;
@@ -216,6 +230,8 @@ FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
       LLMNR = false;
       MulticastDNS = true;
       DNSOverTLS = "opportunistic";
+      DNSStubListener = false;
+      DNSStubListenerExtra = [ "[::1]:90" ];
     };
   };
   networking.resolvconf.enable = false;
@@ -261,7 +277,7 @@ inherit domain;
       interface = [
         lan
       ];
-      except-interface = [ "lo" ];
+      port = 5553;
       bind-interfaces = true;
       enable-ra = false;
 
@@ -274,19 +290,8 @@ "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
       ];
 
       no-resolv = true;
-      server = [ "::1" ];
       dns-loop-detect = true;
 
-      # these next few settings imply trust of the upstream resolver and the path to it
-      query-port = 0; # use single OS-allocated port: faster and more efficient
-      proxy-dnssec = true; # resolved handles dnssec and is caching
-      cache-size = 0; # let resolved do it
-
-      # resolved may know about single-label names
-      # particularly those it synthesises, such as "_gateway" (see systemd-resolved(8))
-      domain-needed = false;
-      stop-dns-rebind = false; # necessary for above
-
       # do not forward reverse lookups for private addresses, respond nxdomain
       # (resolved will not know more than dnsmasq in such cases)
       bogus-priv = true;
@@ -296,7 +301,7 @@
       # resolved will look there anyway
       no-hosts = true;
 
-      localise-queries = true;
+      localise-queries = false;
       local = [
         "/${domain}/"
       ];

@@ -17,7 +17,9 @@ settings = {
       dhcp.enabled = false;
 
       dns = {
-        bind_hosts = [ "::1" ];
+        bind_hosts = [ "::" ];
+
+        hostsfile_enabled = false;
 
         trusted_proxies = [ "::1" ];
         enable_dnssec = true;