This file was missing explicit dnssec-validation. Seems like it was missed in our previous efforts, probably because of the different filename / extension. Rename it to end with *.in to reflect that it is a template file used by copy_setports.