anchor.diff:  {
     options = {
       services.dnscrypt-proxy = {
  -      enable = mkEnableOption ''
  -        Enable dnscrypt-proxy. The proxy relays regular DNS queries to a
  -        DNSCrypt enabled upstream resolver. The traffic between the
  -        client and the upstream resolver is encrypted and authenticated,
  -        which may mitigate the risk of MITM attacks and third-party
  +      enable = mkEnableOption "dnscrypt-proxy" // { description = ''
  +        Whether to enable the DNSCrypt client proxy. The proxy relays
  +        DNS queries to a DNSCrypt enabled upstream resolver. The traffic
  +        between the client and the upstream resolver is encrypted and
  +        authenticated, mitigating the risk of MITM attacks and third-party
           snooping (assuming the upstream is trustworthy).
  -      '';
  +
  +        Enabling this option does not alter the system nameserver; to relay
  +        local queries, prepend <literal>127.0.0.1</literal> to
  +        <option>networking.nameservers</option>.
  +
  +        The recommended configuration is to run DNSCrypt proxy as a forwarder
  +        for a caching DNS client, as in
  +        <programlisting>
  +        {
  +          services.dnscrypt-proxy.enable = true;
  +          services.dnscrypt-proxy.localPort = 43;
  +          services.dnsmasq.enable = true;
  +          services.dnsmasq.servers = [ "127.0.0.1#43" ];
  +          services.dnsmasq.resolveLocalQueries = true; # this is the default
  +        }
  +        </programlisting>
  +     ''; };
         localAddress = mkOption {
           default = "127.0.0.1";
           type = types.string;
           description = ''
  -          Listen for DNS queries on this address.
  +          Listen for DNS queries to relay on this address. The only reason to
  +          change this from its default value is to proxy queries on behalf
  +          of other machines (typically on the local network).
           '';
         };
         localPort = mkOption {
           default = 53;
           type = types.int;
           description = ''
  -          Listen on this port.
  +          Listen for DNS queries to relay on this port. The default value
  +          assumes that the DNSCrypt proxy should relay DNS queries directly.
  +          When running as a forwarder for another DNS client, set this option
  +          to a different value; otherwise leave the default.
           '';
         };
         resolverName = mkOption {
  
positive.code:         type = types.nullOr types.string;
          description = ''
            The name of the upstream DNSCrypt resolver to use. See
            <literal>${resolverListFile}</literal> for alternative resolvers
            (e.g., if you are concerned about logging and/or server
            location).
          '';
  
negative.code:       customResolver = mkOption {
          default = null;
          description = ''
            Use an unlisted resolver (e.g., a private DNSCrypt provider). For
            advanced users only. If specified, this option takes precedence.
          '';
          type = types.nullOr (types.submodule ({ ... }: { options = {
            address = mkOption {
  