diff --git a/etc/systemd/resolved.conf.d/dot-dns0-appliedprivacy.conf b/etc/systemd/resolved.conf.d/dot-dns0-appliedprivacy.conf
new file mode 100644
index 00000000..b9af37f8
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/dot-dns0-appliedprivacy.conf
@@ -0,0 +1,13 @@
+# This is kind of DNS-over-TLS.conf, but with ECS and just the hope of
+# passing restricctive networks with Quad9. Use-case: Steam Deck
+# Or just seeing if it does anything or would blocked queries just go to AP
+[Resolve]
+DNS=2a0f:fc80::#dns0.eu
+DNS=2a0f:fc81::#dns0.eu
+DNS=193.110.81.0#dns0.eu
+DNS=185.253.5.0#dns0.eu
+DNS=[2a02:1b8:10:234::2]:443#dot1.applied-privacy.net
+DNS=146.255.56.98:443#dot1.applied-privacy.net
+Domains=~.
+DNSOverTLS=yes
+Cache=yes