diff --git a/manifests/zone.pp b/manifests/zone.pp
index 097441e..348cae0 100644
--- a/manifests/zone.pp
+++ b/manifests/zone.pp
@@ -30,8 +30,8 @@ define bind::zone (
         fail("transfer_source may only be provided for bind::zone resources with zone_type 'slave' or 'stub'")
     }
 
-    unless !($allow_update != '' and ! $dynamic) {
-        fail("allow_update may only be provided for bind::zone resources with dynamic set to true")
+    unless !($allow_updates != '' and ! $dynamic) {
+        fail("allow_updates may only be provided for bind::zone resources with dynamic set to true")
     }
 
     unless !($dnssec and ! $dynamic) {
diff --git a/templates/named.conf.erb b/templates/named.conf.erb
index 8fc1044..be52acd 100644
--- a/templates/named.conf.erb
+++ b/templates/named.conf.erb
@@ -21,8 +21,10 @@ options {
 	auth-nxdomain <%= @auth_nxdomain ? 'yes' : 'no' %>;
 	listen-on-v6 { any; };
 	dnssec-enable <%= @dnssec ? 'yes' : 'no' %>;
-	dnssec-validation <%= @dnssec ? 'yes' : 'no' %>;
-	dnssec-lookaside <%= @dnssec ? 'auto' : 'no' %>;
+<%- if @dnssec -%>
+	dnssec-validation yes;
+	dnssec-lookaside auto;
+<%- end -%>
 <%- if @version != '' -%>
 	version "<%= @version %>";
 <%- end -%>