Usually DNS is not encrypted and unauthenticated by default. Some countries or provider may change the result of domain resolution.

Enable DNSCrypt

The following snippet will enable DNSCrypt and set it as the default system resolver.

{ # configuration.nix
  services.dnscrypt-proxy = {
    enable = true;
    # the official default resolver is unreliable from time to time
    # either use a different, trust-worthy one from here:
    #   https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv 
    # or setup your own.
    #resolverName = "cs-de";
  };
  networking.nameservers = ["127.0.0.1"];
}