"dnssec-validation auto;" is the default for servers with "recursion no;"
!145 (merged) changed the default value for the
dnssec-validation setting to
auto. This change also applies to servers configured with
recursion no;, which means that servers which were previously not sending any outbound queries themselves started doing so.