Found this on wotan in the global forwarder entry of the named configuration dnssec-enable yes; minimal-responses no-auth-recursive; # houtrackit02.us.netiq.corp is unresolvable otherwise # dnssec-validation auto; dnssec-validation no; ... maybe this is also part of the named configuration on 10.156.160.129 ?