diff --git a/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
new file mode 100644
index 000000000000..aaafec50add1
--- /dev/null
+++ b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
+index 352ea6c0..41a9a1c7 100644
+--- a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
++++ b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
+@@ -3536,7 +3536,7 @@ namespace DnsServerCore.Dns.ZoneManagers
+                     }
+                 }
+ 
+-                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, udpPayloadSize: _dnsServer.UdpPayloadSize, options: eDnsOptions);
++                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, _dnsServer.UdpPayloadSize, request.DnssecOk ? EDnsHeaderFlags.DNSSEC_OK : EDnsHeaderFlags.None, eDnsOptions);
+             }
+         }
+ 
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index a5375f487124..f143be229523 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -41,6 +41,12 @@ buildDotnetModule rec {
     libmsquic
   ];
 
+  # Confirmed correct by upstream, remove when fixed in a release:
+  # https://github.com/TechnitiumSoftware/DnsServer/issues/1967
+  patches = [
+    ./dnssec-do-bit-fix.patch
+  ];
+
   passthru.tests = {
     inherit (nixosTests) technitium-dns-server;
   };