use "dnssec-validation auto"