anchor.diff:              type = types.str;
               description = "Provider fully qualified domain name";
               example = "2.dnscrypt-cert.opendns.com";
  -         };
  -         key = mkOption {
  -           type = types.str;
  -           description = "Provider public key";
  -           example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
  -         }; }; }));
  +          };
  +          key = mkOption {
  +            type = types.str;
  +            description = "Provider public key";
  +            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
  +          };
  +        }; }));
         };
         tcpOnly = mkOption {
           default = false;
           type = types.bool;
           description = ''
  -          Force sending encrypted DNS queries to the upstream resolver
  -          over TCP instead of UDP (on port 443). Enabling this option may
  -          help circumvent filtering, but should not be used otherwise.
  +          Force sending encrypted DNS queries to the upstream resolver over
  +          TCP instead of UDP (on port 443). Use only if the UDP port is blocked.
           '';
         };
       };
  
positive.code: {
    options = {
      services.dnscrypt-proxy = {
        enable = mkEnableOption ''
          Enable dnscrypt-proxy. The proxy relays regular DNS queries to a
          DNSCrypt enabled upstream resolver. The traffic between the
          client and the upstream resolver is encrypted and authenticated,
          which may mitigate the risk of MITM attacks and third-party
          snooping (assuming the upstream is trustworthy).
        '';
        localAddress = mkOption {
          default = "127.0.0.1";
          type = types.string;
          description = ''
            Listen for DNS queries on this address.
          '';
        };
        localPort = mkOption {
          default = 53;
          type = types.int;
          description = ''
            Listen on this port.
          '';
        };
        resolverName = mkOption {
  
negative.code:         type = types.nullOr types.string;
          description = ''
            The name of the upstream DNSCrypt resolver to use. See
            <filename>${resolverListFile}</filename> for alternative resolvers
            (e.g., if you are concerned about logging and/or server
            location).
          '';
  