diff --git a/setup/dns.sh b/setup/dns.sh
index b64a6580..a3d9d173 100755
--- a/setup/dns.sh
+++ b/setup/dns.sh
@@ -63,6 +63,13 @@ for ip in $PRIVATE_IP $PRIVATE_IPV6; do
 done
 
 echo "include: /etc/nsd/zones.conf" >> /etc/nsd/nsd.conf;
+echo "include: /etc/nsd/local.conf" >> /etc/nsd/nsd.conf;
+
+# NSD requires all include files to exist, ensure we have a local.conf.
+
+if [ ! -f /etc/nsd/local.conf ]; then
+    echo "# local zone config" > /etc/nsd/local.conf
+fi
 
 # Create DNSSEC signing keys.