{...}: {
  networking = {
    networkmanager = {
      enable = true;
      dns = "systemd-resolved";
      ethernet = {
        macAddress = "random";
      };
      wifi = {
        backend = "iwd";
        macAddress = "random";
      };
    };

    nameservers = [
      "9.9.9.9#dns.quad9.net"
      "149.112.112.112#dns.quad9.net"
      "2620:fe::fe#dns.quad9.net"
      "2620:fe::9#dns.quad9.net"
    ];
    firewall = {
      enable = true;
    };
    nftables = {
      enable = true;
    };
  };

  services.resolved = {
    enable = true;
    dnssec = "true";
    domains = ["~."];
    fallbackDns = [
      "9.9.9.9#dns.quad9.net"
      "149.112.112.112#dns.quad9.net"
      "2620:fe::fe#dns.quad9.net"
      "2620:fe::9#dns.quad9.net"
    ];
    dnsovertls = "true";
    llmnr = "true";
  };
}