fixed dnssec validation options