options {
        directory "/var/cache/bind";
        forward only;			// Never try resolving other domains
        forwarders { 127.0.0.53; };	// Forward everything to systemd-resolved
        dnssec-validation yes;		// systemd-resolved *requires* DNSSEC
};