diff --git a/roles/knot/templates/knot.conf.j2 b/roles/knot/templates/knot.conf.j2
index 45a0f8d..c661e25 100644
--- a/roles/knot/templates/knot.conf.j2
+++ b/roles/knot/templates/knot.conf.j2
@@ -67,7 +67,8 @@ template:
   # template for automatically created special zones
   - id: catalog
     catalog-role: generate
-    dnssec-signing: off
+    dnssec-signing: on
+    dnssec-policy: default
 
 
 # define zones on this server