Add no-dns-sec option

This makes it possible to disable dns-sec
There is no reason to add this without tests that require it.