diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example
index 9a0dbd7..4f2bcf3 100644
--- a/dnsmasq.conf.example
+++ b/dnsmasq.conf.example
@@ -20,6 +20,10 @@
 # Never forward addresses in the non-routed address spaces.
 #bogus-priv
 
+# Uncomment these to enable DNSSEC validation and caching:
+# (Requires dnsmasq to be built with DNSSEC option.)
+#conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf
+#dnssec
 
 # Uncomment this to filter useless windows-originated DNS requests
 # which can trigger dial-on-demand links needlessly.