diff --git a/tools/catalyst-auto b/tools/catalyst-auto
index 509917c7..ce155d6d 100755
--- a/tools/catalyst-auto
+++ b/tools/catalyst-auto
@@ -243,6 +243,11 @@ verify_dnssec() {
 		echo "DNSSEC does not appear to be working. Bailing out"
 		exit 1
 	fi
+
+	if ! grep -q '^options \<edns0\>' /etc/resolv.conf; then
+		echo "DNSSEC is not enabled in /etc/resolv.conf"
+		exit 1
+	fi
 }
 
 run_catalyst_commands() {