Always require DNSSEC.