diff --git a/etc/systemd/resolved.conf.d/quad9-compat.conf b/etc/systemd/resolved.conf.d/quad9-compat.conf
new file mode 100644
index 00000000..ea7e0da5
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/quad9-compat.conf
@@ -0,0 +1,9 @@
+[Resolve]
+DNS=2620:fe::9 149.112.112.112 2620:fe::fe 9.9.9.9
+Domains=~.
+# see man resolved.conf, may not work if system is down for a long time, +
+# captive portals?
+DNSSEC=allow-downgrade
+# allow downgrade/MITM and captive portals
+DNSOverTLS=opportunistic
+Cache=true