diff --git a/nixos/modules/services/networking/dnscrypt-proxy.nix b/nixos/modules/services/networking/dnscrypt-proxy.nix
index 077aeca457ea..ed658258c7f9 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@@ -82,14 +82,13 @@ in
       };
 
       resolverName = mkOption {
-        default = "dnscrypt.eu-nl";
+        default = "random";
+        example = "dnscrypt.eu-nl";
         type = types.nullOr types.str;
         description = ''
           The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default
-          resolver is located in Holland, supports DNS security
-          extensions, and <emphasis>claims</emphasis> to not
-          keep logs.
+          <filename>${resolverList}</filename>.  The default is to
+          pick a random non-logging resolver that supports DNSSEC.
         '';
       };