Edit /etc/systemd/resolved.conf, make sure you set the following lines (notice the DNSSEC and DNSOverTLS): Then restart the services: My original intention with option DNSOverTLS set to opportunistic is to support Mikrotik’s Walled Garden Wifis that often hijack early connections to make sure you logged in first. — Thanks to opinion_no9 (From https://askubuntu.com/a/1111592/647986) for the option…