diff --git a/templates/named.conf.erb b/templates/named.conf.erb
index a69f4ef..d38988a 100644
--- a/templates/named.conf.erb
+++ b/templates/named.conf.erb
@@ -33,7 +33,7 @@ options {
 	filter-aaaa-on-v4 yes;
 <%- end -%>
 <%- if @dnssec -%>
-	dnssec-validation yes;
+	dnssec-validation auto;
 	dnssec-lookaside auto;
 <%-   if @isc_bind_keys -%>
         bindkeys-file "<%= @isc_bind_keys %>";