diff --git a/network.nix b/network.nix
index 42707b8..428c0ad 100644
--- a/network.nix
+++ b/network.nix
@@ -34,6 +34,7 @@ in
 
     services.resolved.enable = (cfg.dns == "systemd-resolved");
     services.resolved.llmnr = mkForce "false"; # https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/
+    services.resolved.dnssec = "false"; # Causes issues with masquerading DNS
 
     services.unbound.enable = (cfg.dns == "unbound");