moved dns sec as it is no longer used in bind9

templates/named.conf.erb

@@ -28,13 +28,13 @@ options {
 <%- end -%>
 	auth-nxdomain <%= @auth_nxdomain ? 'yes' : 'no' %>;
 	listen-on-v6 { any; };
-	dnssec-enable <%= @dnssec ? 'yes' : 'no' %>;
 <%- if @filter_ipv6 -%>
 	filter-aaaa-on-v4 yes;
 <%- end -%>
 <%- if @dnssec -%>
 	dnssec-validation yes;
 	dnssec-lookaside auto;
+	dnssec-enable <%= @dnssec ? 'yes' : 'no' %>;
 <%-   if @isc_bind_keys -%>
         bindkeys-file "<%= @isc_bind_keys %>";
 <%-   end -%>