diff --git a/etc/systemd/resolved.conf.d/unbound.conf b/etc/systemd/resolved.conf.d/unbound.conf
index e26cf66a..2ca9ac6c 100644
--- a/etc/systemd/resolved.conf.d/unbound.conf
+++ b/etc/systemd/resolved.conf.d/unbound.conf
@@ -4,7 +4,8 @@ DNS=127.0.0.1
 DNS=::1
 Domains=~.
 # Done better by Unbound, no failed-auxiliary (https://github.com/systemd/systemd/issues/9867)
-#DNSSEC=no
+#DNSSEC=allow-downgrade
+DNSSEC=yes
 # Not needed on localhost
 DNSOverTLS=no
 # Done by Unbound