diff --git a/nix/nixos-module/container/dns.nix b/nix/nixos-module/container/dns.nix
index 78ea8be..3fa2586 100644
--- a/nix/nixos-module/container/dns.nix
+++ b/nix/nixos-module/container/dns.nix
@@ -324,7 +324,8 @@ in
             algorithm hmac-sha256;
             secret "${inputs.zentralwerk-network-key.lib.dyndnsKey}";
           };
-
+        '';
+        extraOptions = ''
           # allow underscores in dynamic hostnames
           ${lib.concatMapStringsSep "\n" (type: ''
             check-names ${type} ignore;