dnssec-validation auto fails in older bind versions