How about: - If dnssec-lookaside is configured as either auto or explicitly using dlv.isc.org, disable it and log a warning - if dnssec-lookaside is explicitly configured using another server, log this during start-up (mentioning that the configuration is permitted because it does not use dlv.isc.org) ?