diff --git a/etc/systemd/resolved.conf.d/snopyta-strict.conf b/etc/systemd/resolved.conf.d/snopyta-strict.conf
new file mode 100644
index 00000000..17052602
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/snopyta-strict.conf
@@ -0,0 +1,8 @@
+# Snopyta / systemd-resolved. For people who don't panic when DNSSEC or
+# DoT doesn't work and captive portals attack? See README.md
+[Resolve]
+DNS=2a01:4f9:2a:1919::9301#fi.dot.dns.snopyta.org 95.216.24.230#fi.dot.dns.snopyta.org
+Domains=~.
+DNSSEC=true
+DNSOverTLS=true
+Cache=true