Change:
is empty as a default value, and has the description of: A list of IPv4 and IPv6 addresses to use as the fallback DNS servers. If this option is empty, a compiled-in list of DNS servers is used instead. The "compiled-in list" seems to be: This means that if somebody wanted to intentionally set the list to an empty value, the person will need to try some workarounds. Just set the compiled value as the default value, and stop relying on the compiled-in list. This affects , , and versions of at least .
I marked this as stale due to inactivity. &rarr;
set to empty value is not empty, it affects . For me it's security issue, I don't want my server to contact public DNS without being explicitly allowed to do so.
Relevant upstream issue: Looks like they don't care to change it. This value only seems to be used as a last resort when the isn't set and "if none could be learnt via dhcp or ppp".
Oh, he cares. He cares so much and has a strong oppinion on how this should be done that he refuses to change it. Don't mistake Poetterings answer for not caring. He cares deeply.
Note that overriding default values is indeed possible using a single statement with no value. In fact this would be supported by the NixOS module if it weren't for the default being injected on an empty list. This would be a breaking change for a select few I assume, but to be and to and to be then providing as a value (from a user perspective) would set the config value to which would override the upstream behaviour to use no fallback servers. As a stopgap measure you can use this in your config, but being able to use this without extraConfig would be nice considering there is an actual option for this kind of thing. Edit: gonna send a pull request

Discussion:
- If [`system.stateVersion`](#opt-system.stateVersion) is >=23.11, `pkgs.nextcloud27` will be installed by default. - Please note that an upgrade from v26 (or older) to v28 directly is not possible. Please upgrade to `nextcloud27` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud27;`](options.html#opt-services.nextcloud.package). <ins> - `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead. </ins> - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively. Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.

}; services.resolved.fallbackDns = mkOption { <del> default = [ ]; </del> <ins> default = null; </ins> example = [ "8.8.8.8" "2001:4860:4860::8844" ]; <del> type = types.listOf types.str; </del> <ins> type = types.nullOr (types.listOf types.str); </ins> description = lib.mdDoc '' A list of IPv4 and IPv6 addresses to use as the fallback DNS servers. <del> If this option is empty, a compiled-in list of DNS servers is used instead. </del> <ins> If this option is null, a compiled-in list of DNS servers is used instead. Setting this option to an empty list will override the built-in list to an empty list, disabling fallback. </ins> ''; };

[Resolve] ${optionalString (config.networking.nameservers != []) "DNS=${concatStringsSep " " config.networking.nameservers}"} <del> ${optionalString (cfg.fallbackDns != []) </del> <ins> ${optionalString (cfg.fallbackDns != null) </ins> "FallbackDNS=${concatStringsSep " " cfg.fallbackDns}"} ${optionalString (cfg.domains != []) "Domains=${concatStringsSep " " cfg.domains}"}