{
  services.dnsproxy = {
    enable = true;
    flags = [
      "--cache"
      "--cache-size=64000000"
      "--cache-optimistic"
    ];
    settings = rec {
      upstream = [ "https://base.dns.mullvad.net/dns-query" ];
      listen-addrs = [ "127.0.0.1" ];
      fallback = [ "1.1.1.1" ];
      bootstrap = fallback;
    };
  };
}