<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div>Hi,</div><div><br></div><div>Does BIND9 allow per zone dnssec setting? I wanted to forward requests for certain zone to remote resolvers which doesn't support DNSSEC and also disable dnssec validation for that particular zone because forward-only resolver will return SERVFAIL to the client when the remote resolves don't support DNSSEC.</div><div><br></div><div>I was hoping I could configure dnssec on the zone level but that didn't appear to be supported (snippet from my test config):</div><div><br></div><div><div><div>zone "isc.org" {</div><div> type forward;</div><div> dnssec-validation no;</div><div> forward only;</div><div> forwarders {</div><div> 208.67.220.220;</div><div> };</div><div>}</div></div></div><div><br></div><div><br></div></div></body></html>