On Tue, Oct 22, 2013 at 12:47:38AM +1100, Mark Andrews <marka at isc.org> wrote a message of 98 lines which said: > dns64 { > clients { me; }; > break-dnssec yes; > }; OK, it works without the DO bit ("dig +nodnssec", I had +dnssec in my ~/.digrc) or with "break-dnssec yes". Thanks.