anchor.diff:              be able to trigger a downgrade to non-DNSSEC mode by
               synthesizing a DNS response that suggests DNSSEC was not
               supported.
  -          </para></listitem>
  -        </varlistentry>
  -        <varlistentry>
  -          <term><literal>"false"</literal></term>
  -          <listitem><para>
  -            DNS lookups are not DNSSEC validated.
  -          </para></listitem>
  -        </varlistentry>
  -        </variablelist>
  +        - `"false"`: DNS lookups are not DNSSEC validated.
         '';
       };
   
       services.resolved.extraConfig = mkOption {
         default = "";
         type = types.lines;
  -      description = ''
  +      description = lib.mdDoc ''
           Extra config to append to resolved.conf.
         '';
       };
  
positive.code:       default = "allow-downgrade";
        example = "true";
        type = types.enum [ "true" "allow-downgrade" "false" ];
        description = ''
          If set to
          <variablelist>
          <varlistentry>
            <term><literal>"true"</literal></term>
            <listitem><para>
              all DNS lookups are DNSSEC-validated locally (excluding
              LLMNR and Multicast DNS). Note that this mode requires a
              DNS server that supports DNSSEC. If the DNS server does
              not properly support DNSSEC all validations will fail.
            </para></listitem>
          </varlistentry>
          <varlistentry>
            <term><literal>"allow-downgrade"</literal></term>
            <listitem><para>
              DNSSEC validation is attempted, but if the server does not
              support DNSSEC properly, DNSSEC mode is automatically
              disabled. Note that this mode makes DNSSEC validation
  
negative.code:       default = [ ];
        example = [ "8.8.8.8" "2001:4860:4860::8844" ];
        type = types.listOf types.str;
        description = lib.mdDoc ''
          A list of IPv4 and IPv6 addresses to use as the fallback DNS servers.
          If this option is empty, a compiled-in list of DNS servers is used instead.
        '';
  