I had this on one laptop where I absolutely needed to use network damager for managing WiFi due to reasons. Thus, the rather weird config on that.

   # Enable Network Manager for WiFi networking
   networking.networkmanager = {
     enable = true;
     connectionConfig."connection.mdns" = 2;
     dns = "systemd-resolved";
     # firewallBackend = "nftables"; ## Deprecated
   };
   networking.resolvconf.dnsSingleRequest = true;
   services.resolved = {
     enable = true;
     llmnr = "false";
     fallbackDns = [
 #      "8.8.8.8"
 #      "2001:4860:4860::8888"
       "1.1.1.1#cloudflare-dns.com"
       "1.0.0.1#cloudflare-dns.com"
       "2606:4700:4700::1111#cloudflare-dns.com"
       "2606:4700:4700::1001#cloudflare-dns.com"
     ];
     extraConfig = ''
         MulticastDNS=yes
         Cache=no-negative
       DNSOverTLS=opportunistic
       DNSStubListenerExtra=::53
     '';
   };

Firewall needs to be handled as well, like:

   # Open ports in the firewall.
   networking.nftables.enable = config.networking.firewall.enable || false ;
   networking.firewall = {
     enable = false;
     allowedTCPPorts = [
       "22"
     ];
     allowedUDPPorts = [
       ""
     ];
     extraInputRules = ''
       ip6 daddr ff02::fb/128 udp sport 5353 dport 5353 accept
       ip daddr 224.0.0.251 udp sport 5353 dport 5353 accept
     '';
   };

/etc/nsswitch.conf might or might not need adjusting as well for the hosts: -line. Namely, the resolve needs to be there correctly at the correct place depending on your other setup:

hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns

   Most computer users neglect to type the trailing dot at the end of a
   fully qualified domain name, making it a relative domain name (e.g.,
   "www.example.com").  In the event of network outage, attempts to
   positively resolve the name as entered will fail, resulting in
   application of the search list, including ".local.", if present.  A
   malicious host could masquerade as "www.example.com." by answering
   the resulting Multicast DNS query for "www.example.com.local.".  To
   avoid this, a host MUST NOT append the search suffix ".local.", if
   present, to any relative (partially qualified) host name containing
   two or more labels.  Appending ".local." to single-label relative
   host names is acceptable, since the user should have no expectation
   that a single-label host name will resolve as is.  However, users who
   have both "example.com" and "local" in their search lists should be
   aware that if they type "www" into their web browser, it may not be
   immediately clear to them whether the page that appears is
   "www.example.com" or "www.local".