NixOS systemd-resolved ↔ ca-certificates: Does DNS-over-TLS use the NixOS-managed trust store by default?
In NixOS 23.11 and later, the file /etc/ssl/certs/ca-certificates.crt is a symlink to the NixOS store path managed by the ca-certificates package, which systemd-resolved reads as the default OpenSSL trust store. This suggests that DNS-over-TLS (DoT) validation could work without extra configuration when the package is installed. However, DNSSEC validation is
nixos