Hi, The named conf for the hybrid dns aws demo is broken. /etc/named.conf:13: option 'dnssec-enable' is obsolete and should be removed /etc/named.conf:15: option 'dnssec-lookaside' no longer exists This two options are no longer avalible. Once those lines are removed the dns validation works as expected.