{ config, pkgs, ... }:
{
  services.bind = {
    enable = true;

    zones = {
      "encryptionin.space" = {
        name = "encryptionin.space";
        master = false;
        file = "db.encryptionin.space";
        masters = [ "92.51.163.43" ];
        # extraConfig = ''
        #   dnssec-policy default;
        #   inline-signing yes;
        # '';
      };
      "queerscriptors.org" = {
        name = "queerscriptors.org";
        master = false;
        file = "db.queerscriptors.org";
        masters = [ "92.51.163.43" ];
        # extraConfig = ''
        #   dnssec-policy default;
        #   inline-signing yes;
        # '';
      };
    };
  };
  networking.firewall.allowedUDPPorts = [ 53 ];
}