NixOS systemd-resolved ↔ ca-certificates: Does DNS-over-TLS use the NixOS-managed trust store by default?

DNS-over-TLS and the NixOS Trust Store

Yes, systemd-resolved automatically uses the NixOS-managed trust store for validating DNS-over-TLS (DoT) upstream certificates. Because /etc/ssl/certs/ca-certificates.crt is a symlink to the Nix store path provided by the ca-certificates package, systemd-resolved inherits this path as its default OpenSSL trust store. No additional NixOS module configuration is required for the daemon to recognize standard Certificate Authorities (CAs) when DoT is enabled.

DNSSEC Validation Requirements

Unlike DoT certificate validation, DNSSEC validation is not activated by the mere presence of the unbound-anchor package. It must be explicitly declared in your configuration.nix. While the tools to manage trust anchors may be installed on the system, systemd-resolved will not perform DNSSEC validation unless the DNSSEC setting is toggled and a valid trust anchor is referenced.

Declarative Configuration for DNSSEC and DoT

To persistently enable both DNS-over-TLS and DNSSEC across nixos-rebuild cycles, use the following declarative approach in your configuration.nix:

services.resolved = {
  # Enable DNS-over-TLS
  extraConfig = "DNSOverTLS=yes";
  
  # Enable DNSSEC validation
  dnssec = "true";
};

Note on Trust Anchors: In most modern NixOS versions, setting dnssec = "true" allows systemd-resolved to use the system's default trust anchors. If you require a specific anchor file, you can append TrustAnchor=path/to/file to the extraConfig string.

Verification and Diagnostics

To verify that your configuration is active and the protocol is being used, run the following command:

resolvectl status

Look for the +DNSSEC flag and verify that the protocol for your upstream server is listed as TLS. If you are using a private CA for your DoT provider, ensure the certificate is added via security.pki.certificates to be included in the symlinked bundle.

Diagnostic Question: Are you using a public DNS provider (e.g., Cloudflare, Quad9) or a private/internal DNS server with a custom CA? This determines if security.pki.certificates configuration is necessary.