diff --git a/roles/install_bind/templates/named.conf.j2 b/roles/install_bind/templates/named.conf.j2
index 9947b04..9e0cadb 100644
--- a/roles/install_bind/templates/named.conf.j2
+++ b/roles/install_bind/templates/named.conf.j2
@@ -5,7 +5,7 @@ options {
     pid-file "/run/named/named.pid";
 
     dnssec-enable yes;
-    dnssec-validation yes;
+    dnssec-validation auto;
 
     auth-nxdomain no;    # conform to RFC1035