diff --git a/roles/dns/templates/recursor.conf.j2 b/roles/dns/templates/recursor.conf.j2
index f2742a9..4beb833 100644
--- a/roles/dns/templates/recursor.conf.j2
+++ b/roles/dns/templates/recursor.conf.j2
@@ -8,6 +8,12 @@ allow-from=127.0.0.0/8
 #
 daemon=yes
 
+#################################
+# dnssec        DNSSEC mode: off/process-no-validate (default)/process/log-fail/validate
+#
+# dnssec=process-no-validate
+dnssec=off
+
 #################################
 # local-address IP addresses to listen on, separated by spaces or commas. Also accepts ports.
 #