Enable DNSSEC validation in the resolver by default

manifests/init.pp

@@ -2,6 +2,7 @@ class bind (
 	$confdir    = $bind::params::confdir,
 	$cachedir   = $bind::params::cachedir,
 	$forwarders = [],
+	$dnssec     = true,
 ) inherits bind::params {
 
 	$auth_nxdomain = false

templates/named.conf.erb

@@ -14,4 +14,7 @@ options {
 <%- end -%>
 	auth-nxdomain <%= auth_nxdomain ? 'yes' : 'no' %>;
 	listen-on-v6 { any; };
+	dnssec-enable <%= dnssec ? 'yes' : 'no' %>;
+	dnssec-validation <%= dnssec ? 'yes' : 'no' %>;
+	dnssec-lookaside <%= dnssec ? 'auto' : 'no' %>;
 };