diff --git a/test/pdns/recursor.conf b/test/pdns/recursor.conf
index 3021a700..35114528 100644
--- a/test/pdns/recursor.conf
+++ b/test/pdns/recursor.conf
@@ -7,20 +7,31 @@
 # This file is copyright under the latest version of the EUPL.
 # Please see LICENSE file for your rights under this license.
 
-# Local DNS address and port
-local-address=127.0.0.1:5555
-
-# Use authoritative server for ftl., dnssec. and arpa. zones
-forward-zones=ftl=127.0.0.1:5554,168.192.in-addr.arpa=127.0.0.1:5554,ip6.arpa=127.0.0.1:5554,dnssec=127.0.0.1:5554,bogus=127.0.0.1:5554
-
-# In this mode the Recursor acts as a “security aware, non-validating”
-# nameserver, meaning it will set the DO-bit on outgoing queries and will
-# provide DNSSEC related RRsets (NSEC, RRSIG) to clients that ask for them (by
-# means of a DO-bit in the query), except for zones provided through the
-# auth-zones setting. It will not do any validation in this mode, not even when
-# requested by the client.
-# The default mode until PowerDNS Recursor 4.5.0.
-dnssec=process-no-validate
-
-# Enable LUA support
-lua-dns-script=/etc/pdns/luadns.lua
+dnssec:
+  validation: process-no-validate
+incoming:
+  listen:
+  - 127.0.0.1:5555
+recursor:
+  forward_zones:
+  - zone: ftl
+    recurse: false
+    forwarders:
+    - 127.0.0.1:5554
+  - zone: 168.192.in-addr.arpa
+    recurse: false
+    forwarders:
+    - 127.0.0.1:5554
+  - zone: ip6.arpa
+    recurse: false
+    forwarders:
+    - 127.0.0.1:5554
+  - zone: dnssec
+    recurse: false
+    forwarders:
+    - 127.0.0.1:5554
+  - zone: bogus
+    recurse: false
+    forwarders:
+    - 127.0.0.1:5554
+  lua_dns_script: /etc/pdns/luadns.lua
\ No newline at end of file