DNS forwarding proxy does not work with DNSSEC in case a request was redirected by BloxOne Threat Defense Cloud. If you are running DNS forwarding proxy on NIOS, you must disable DNSSEC validation. Even if you disable DNSSEC validation, validation still takes place through BloxOne Threat Defense Cloud. For more information, see Using Forwarders. To enable DNS forwarding proxy to work with DNSSEC in case a request was redirected by BloxOne Threat Defense Cloud, see Enabling DNS Forwarding Proxy to Work with DNSSEC.