On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf": dnssec #dnssec-chec

On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf": dnssec #dnssec-check-unsigned conf-file=/usr/share/dnsmasq-base/trust-anchors.conf Of course, it's possible to strip the signing unless you use Google DNS or whatever and uncomment the "dnssec-check-unsigned" line.