diff --git a/applications/dns/dns.nix b/applications/dns/dns.nix
index da8577f..3286a98 100644
--- a/applications/dns/dns.nix
+++ b/applications/dns/dns.nix
@@ -369,7 +369,7 @@ in {
 
       # piles of no valid RRSIG resolving 'com/DS/IN' errors
       extraOptions = ''
-        dnssec-validation yes;
+        dnssec-validation auto;
       '';
 
       # set the upstream dns servers