From d1b6a47d46471cbf880986d9d0cd18bd19e71eca Mon Sep 17 00:00:00 2001
From: Markus Hauschild <markus@moepman.eu>
Date: Mon, 23 Jan 2017 20:09:43 +0100
Subject: [PATCH] Disable DNSSEC for resolving.

---
 roles/dns/templates/recursor.conf.j2 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/dns/templates/recursor.conf.j2 b/roles/dns/templates/recursor.conf.j2
index f2742a9..4beb833 100644
--- a/roles/dns/templates/recursor.conf.j2
+++ b/roles/dns/templates/recursor.conf.j2
@@ -8,6 +8,12 @@ allow-from=127.0.0.0/8
 #
 daemon=yes
 
+#################################
+# dnssec        DNSSEC mode: off/process-no-validate (default)/process/log-fail/validate
+#
+# dnssec=process-no-validate
+dnssec=off
+
 #################################
 # local-address IP addresses to listen on, separated by spaces or commas. Also accepts ports.
 #