"dnssec-validation auto;" is the default for servers with "recursion no;"

!145 (merged) changed the default value for the dnssec-validation setting to auto. This change also applies to servers configured with recursion no;, which means that servers which were previously not sending any outbound queries themselves started doing so.