diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index 79f8edb..0d96f9b 100644
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -7,6 +7,9 @@ lookup_options:
     merge:
       strategy: deep
 
+# this switch installs bind-utils
+bind::defaults::nsupdate_package: true
+
 profiles::ntp::client::ntp_role: 'roles::infra::ntp::server'
 profiles::ntp::client::peers:
   - 0.pool.ntp.org
diff --git a/site/profiles/manifests/dns/base.pp b/site/profiles/manifests/dns/base.pp
index 6510453..6bd2458 100644
--- a/site/profiles/manifests/dns/base.pp
+++ b/site/profiles/manifests/dns/base.pp
@@ -5,6 +5,9 @@ class profiles::dns::base (
   Array  $nameservers = ['8.8.8.8', '1.1.1.1'],
 ){
 
+  # install bind_utils
+  include bind::updater
+
   # if ns_role is set, find all hosts matching that enc_role
   if $ns_role == undef {
     $nameserver_array = $nameservers