dnssec-validation yes;
<% end -%>
-<% if classes.include?('named::authoritative') and not classes.include?('named::primary') -%>
+<% if classes.include?('named::authoritative') and not scope.lookupvar('site::nodeinfo')['dns_primary'] -%>
rate-limit {
responses-per-second 25;
window 5;