[Resolve]
DNS={{ network_ipv4_dns | default('1.1.1.1') }}
FallbackDNS=8.8.8.8
DNSOverTLS={{ 'no' if network_ipv4_dns is defined else 'yes' }}
DNSSEC={{ 'no' if network_ipv4_dns is defined else 'yes' }}
# use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
Domains=~.

# Enable multicast DNS for .local domain resolution (replaces avahi functionality)
MulticastDNS=yes

# Disable LLMNR to prevent reverse DNS lookup delays
LLMNR=no

Cache=yes
CacheFromLocalhost=no

# Reduce timeout for faster reverse DNS fallback
ResolveUnicastSingleLabel=no

# Enable DNS stub listener on 127.0.0.53:53
DNSStubListener=yes

# Read /etc/hosts file
ReadEtcHosts=yes

# Don't resolve single-label names via unicast DNS
ResolveUnicastSingleLabel=no