[Resolve]
DNS={{ network_ipv4_dns | default('1.1.1.1 2606:4700:4700::1111') }}
FallbackDNS={{ network_ipv6_dns | default('8.8.8.8 2001:4860:4860::8888') }}
DNSOverTLS={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }}
DNSSEC={{ 'no' if (network_ipv4_dns is defined or network_ipv6_dns is defined) else 'yes' }}
# use interface-specific DNS when available but fall back to global (required for VPN DNS to work)
Domains=~.

# Enable multicast DNS for .local domain resolution (replaces avahi functionality)
MulticastDNS=yes

# Disable LLMNR to prevent reverse DNS lookup delays
LLMNR=no

Cache=yes
CacheFromLocalhost=no

# Reduce timeout for faster reverse DNS fallback
ResolveUnicastSingleLabel=no

# Enable DNS stub listener on 127.0.0.53:53
DNSStubListener=yes

# Read /etc/hosts file
ReadEtcHosts=yes

# Don't resolve single-label names via unicast DNS
ResolveUnicastSingleLabel=no