NixOS systemd-resolved ↔ ca-certificates: Does DNS-over-TLS use the NixOS-managed trust store by default?

In NixOS 23.11 and later, the file /etc/ssl/certs/ca-certificates.crt is a symlink to the NixOS store path managed by the ca-certificates package, which systemd-resolved reads as the default OpenSSL trust store. This suggests that DNS-over-TLS (DoT) validation could work without extra configuration when the package is installed. However, DNSSEC validation is not enabled by default; the trust‑anchor file from unbound-anchor must be referenced explicitly in /etc/systemd/resolved.conf (or via configuration.nix) to activate DNSSEC=yes and TrustAnchor. The community is still debating whether DNSSEC should be turned on by default, weighing security gains against possible validation failures from outdated trust anchors.

Given these points, the precise goal is to confirm whether the existing NixOS defaults already provide secure DoT validation and what additional steps are required to enable DNSSEC reliably across nixos-rebuild cycles.

• Does systemd-resolved automatically use /etc/ssl/certs/ca-certificates.crt for validating DNS-over-TLS upstream certificates without any extra NixOS module configuration?
• Is DNSSEC validation activated for systemd-resolved when the unbound-anchor package is present, or must it be explicitly declared in configuration.nix?
• What is the recommended, declarative way to persistently enable DNSSEC for systemd-resolved in NixOS to avoid manual edits being overwritten?