From 79167f3966ee777e30b010b2b397274497ee051f Mon Sep 17 00:00:00 2001
From: Brendan Golden <git@brendan.ie>
Date: Wed, 18 Jun 2025 01:57:35 +0100
Subject: [PATCH] fix: dnssec-validation  needed to be set to auto, which is
 now its default value.

https://bind9.readthedocs.io/en/v9.18.13/reference.html#namedconf-statement-dnssec-validation
---
 applications/dns/dns.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/dns/dns.nix b/applications/dns/dns.nix
index da8577f..3286a98 100644
--- a/applications/dns/dns.nix
+++ b/applications/dns/dns.nix
@@ -369,7 +369,7 @@ in {
 
       # piles of no valid RRSIG resolving 'com/DS/IN' errors
       extraOptions = ''
-        dnssec-validation yes;
+        dnssec-validation auto;
       '';
 
       # set the upstream dns servers