diff --git a/hosts/nachtigall/default.nix b/hosts/nachtigall/default.nix
index 09fd08f..a9f039c 100644
--- a/hosts/nachtigall/default.nix
+++ b/hosts/nachtigall/default.nix
@@ -74,16 +74,16 @@
   ];
   networking.defaultGateway = "138.201.80.65";
   networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
-  networking.nameservers = [
-    # cloudflare
-    "1.1.1.1"
-    "2606:4700:4700::1111"
-    "2606:4700:4700::1001"
-    # google
-    "8.8.8.8"
-    "2001:4860:4860::8888"
-    "2001:4860:4860::8844"
-  ];
+
+  services.resolved = {
+    enable = true;
+    extraConfig = ''
+      DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net 193.110.81.0#dns0.eu 185.253.5.0#dns0.eu 2a0f:fc80::#dns0.eu 2a0f:fc81::#dns0.eu
+      FallbackDNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net
+      Domains=~.
+      DNSOverTLS=yes
+    '';
+  };
 
   users.users.root.initialHashedPassword = "$y$j9T$bIN6GjQkmPMllOcQsq52K0$q0Z5B5.KW/uxXK9fItB8H6HO79RYAcI/ZZdB0Djke32";