diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
index 23e9c92026..810bb916c1 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
@@ -132,6 +132,14 @@
         <type>dropdown</type>
         <help>Default is "No". Set to "Auto" to use the static trust anchor configuration by the system.</help>
     </field>
+    <field>
+        <id>general.validate_except</id>
+        <label>DNSSEC Validate Except</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <help>Specify a list of domain names at and beneath which DNSSEC validation should not be performed (essential for internal split DNS zones in forward zones).</help>
+    </field>
     <field>
         <id>general.hidehostname</id>
         <label>Hide Hostname</label>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
index 238c9dc248..2b04c727db 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
@@ -125,6 +125,13 @@
             <Default>no</Default>
             <Required>Y</Required>
         </dnssecvalidation>
+        <validate_except type="HostnameField">
+            <Required>N</Required>
+            <AsList>Y</AsList>
+            <IsDNSName>Y</IsDNSName>
+            <IpAllowed>N</IpAllowed>
+            <ValidationMessage>[%s] is not a valid domain name.</ValidationMessage>
+        </validate_except>
         <hidehostname type="BooleanField">
             <Default>0</Default>
             <Required>Y</Required>
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index 9196b5de3e..112d4e529a 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -80,6 +80,13 @@ options {
 {% if helpers.exists('OPNsense.bind.general.dnssecvalidation') and OPNsense.bind.general.dnssecvalidation != '' %}
         dnssec-validation    {{ OPNsense.bind.general.dnssecvalidation }};
 {% endif %}
+{% if helpers.exists('OPNsense.bind.general.validate_except') and OPNsense.bind.general.validate_except != '' %}
+        validate-except {
+{% for domain in OPNsense.bind.general.validate_except.split(',') %}
+                "{{ domain }}";
+{% endfor %}
+        };
+{% endif %}
 {% if helpers.exists('OPNsense.bind.general.hidehostname') and OPNsense.bind.general.hidehostname == '1' %}
         hostname none;
 {% endif %}