diff --git a/templates/named.conf.erb b/templates/named.conf.erb
index 8fc1044..be52acd 100644
--- a/templates/named.conf.erb
+++ b/templates/named.conf.erb
@@ -21,8 +21,10 @@ options {
 	auth-nxdomain <%= @auth_nxdomain ? 'yes' : 'no' %>;
 	listen-on-v6 { any; };
 	dnssec-enable <%= @dnssec ? 'yes' : 'no' %>;
-	dnssec-validation <%= @dnssec ? 'yes' : 'no' %>;
-	dnssec-lookaside <%= @dnssec ? 'auto' : 'no' %>;
+<%- if @dnssec -%>
+	dnssec-validation yes;
+	dnssec-lookaside auto;
+<%- end -%>
 <%- if @version != '' -%>
 	version "<%= @version %>";
 <%- end -%>