diff --git a/tests/realmd_join_sssd.pm b/tests/realmd_join_sssd.pm
index 5e1ab913..911a03f9 100644
--- a/tests/realmd_join_sssd.pm
+++ b/tests/realmd_join_sssd.pm
@@ -56,8 +56,6 @@ sub run {
         # deploy as a replica
         my ($ip, $hostname) = split(/ /, get_var("POST_STATIC"));
         my $args = "--ip-address=$ip --setup-dns --auto-forwarders --setup-ca --allow-zone-overlap -U --principal admin --admin-password monkeys123";
-        my $relnum = get_release_number;
-        $args .= ' --no-dnssec-validation' if ($relnum > 37);
         assert_script_run "ipa-replica-install $args", 1500;
 
         # enable and start the systemd service
diff --git a/tests/role_deploy_domain_controller.pm b/tests/role_deploy_domain_controller.pm
index 71b80c65..ca4070a8 100644
--- a/tests/role_deploy_domain_controller.pm
+++ b/tests/role_deploy_domain_controller.pm
@@ -34,11 +34,6 @@ sub run {
     assert_script_run "systemctl restart firewalld.service";
     # deploy the server
     my $args = "-U --auto-forwarders --realm=TEST.OPENQA.FEDORAPROJECT.ORG --domain=test.openqa.fedoraproject.org --ds-password=monkeys123 --admin-password=monkeys123 --setup-dns --reverse-zone=2.16.172.in-addr.arpa --allow-zone-overlap";
-    # FIXME: For upgrades to F>34, we turn off dnssec to avoid hitting
-    # #1999321. For all deployments on F>37, we turn it off to avoid
-    # hitting #2117859
-    my $relnum = get_release_number;
-    $args .= ' --no-dnssec-validation' if ($relnum > 37 || (get_var("UPGRADE") && $relnum > 34));
     assert_script_run "ipa-server-install $args", 1200;
     # enable and start the systemd service
     assert_script_run "systemctl enable ipa.service";