options {
    ...
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-enable yes;
    dnssec-validation yes;
    ...