diff --git a/filtermail/Cargo.lock b/filtermail/Cargo.lock
index db16ca05..1bef5eee 100644
--- a/filtermail/Cargo.lock
+++ b/filtermail/Cargo.lock
@@ -268,6 +268,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -582,6 +591,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
 dependencies = [
  "async-trait",
+ "bitflags",
  "cfg-if",
  "data-encoding",
  "enum-as-inner",
@@ -593,7 +603,9 @@ dependencies = [
  "once_cell",
  "rand 0.9.2",
  "ring",
+ "rustls-pki-types",
  "thiserror",
+ "time",
  "tinyvec",
  "tokio",
  "tracing",
@@ -919,6 +931,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
 [[package]]
 name = "num-integer"
 version = "0.1.46"
@@ -1060,6 +1078,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -1312,6 +1336,15 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -1530,6 +1563,25 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
diff --git a/filtermail/Cargo.toml b/filtermail/Cargo.toml
index 8895d142..3a2b0f75 100644
--- a/filtermail/Cargo.toml
+++ b/filtermail/Cargo.toml
@@ -20,7 +20,7 @@ log = "0.4.29"
 env_logger = "0.11.9"
 governor = "0.10.4"
 viadkim = { version = "0.2.0" }
-hickory-resolver = "0.25.2"
+hickory-resolver = { version = "0.25.2", features = ["dnssec-ring"] }
 lru = "0.16.3"
 parking_lot = "0.12.5"
 
diff --git a/filtermail/src/dkim_verifier.rs b/filtermail/src/dkim_verifier.rs
index 9ce00958..97a396f9 100644
--- a/filtermail/src/dkim_verifier.rs
+++ b/filtermail/src/dkim_verifier.rs
@@ -40,7 +40,17 @@ impl CachedResolver {
     /// Creates a new [`CachedResolver`].
     pub fn new() -> Result<Self, crate::error::Error> {
         // Use resolv.conf
-        let dns_resolver = TokioResolver::builder(TokioConnectionProvider::default())?.build();
+        let dns_resolver = {
+            let mut builder = TokioResolver::builder(TokioConnectionProvider::default())?;
+            // https://github.com/hickory-dns/hickory-dns/issues/3519
+            builder.options_mut().validate = true;
+            builder.build()
+        };
+
+        assert!(
+            dns_resolver.options().validate,
+            "incorrect resolver config: DNSSEC disabled; exiting"
+        );
 
         let cache = Arc::new(parking_lot::Mutex::new(LruCache::new(LRU_CACHE_CAPACITY)));