[Resolve]
# Use this instead of the per-link DNS servers
Domains=~.
DNS=194.242.2.2#doh.mullvad.net [2a07:e340::2]#doh.mullvad.net
# Don't use built-in list of fallback DNS servers
FallbackDNS=
DNSOverTLS=yes
# DNSSEC=allow-downgrade # Validate DNSSEC only if upstream DNS server supports it
# DNSSEC=true # Always validate DNSSEC which breaks name resolution for servers that do not support it