When you start your WireGuard interface up, this command will direct systemd-resolved to use the DNS server at 9.9. 9.9 (or at 149.112. 112.112 , if 9.9. 9.9 is not available) to resolve queries for any domain name.