From d7289cace3b87a593ce114df33ccb5a02fb9fcff Mon Sep 17 00:00:00 2001
From: Stefan Ellmauthaler <stefan.ellmauthaler@gmail.com>
Date: Mon, 24 Feb 2025 09:22:08 +0100
Subject: [PATCH] disable dnssec in resolved

Signed-off-by: Stefan Ellmauthaler <stefan.ellmauthaler@gmail.com>
---
 modules/server/unbound.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/server/unbound.nix b/modules/server/unbound.nix
index 3fbd5fd..4743b73 100644
--- a/modules/server/unbound.nix
+++ b/modules/server/unbound.nix
@@ -12,7 +12,7 @@ with lib; {
       services = {
         resolved = {
           enable = true;
-          dnssec = "allow-downgrade";
+          # dnssec = "allow-downgrade";
           llmnr = "true";
           fallbackDns = ["127.0.0.1" "::1"];
           extraConfig = ''