services.resolved.dnsovertls

If set to

• "true": all DNS lookups will be encrypted. This requires that the DNS server supports DNS-over-TLS and has a valid certificate. If the hostname was specified via the address#hostname format in services.resolved.domains then the specified hostname is used to validate its certificate.
• "opportunistic": all DNS lookups will attempt to be encrypted, but will fallback to unecrypted requests if the server does not support DNS-over-TLS. Note that this mode does allow for a malicious party to conduct a downgrade attack by immitating the DNS server and pretending to not support encryption.
• "false": all DNS lookups are done unencrypted.