diff --git a/tests/role_deploy_domain_controller.pm b/tests/role_deploy_domain_controller.pm
index 35ec6a6f..71b80c65 100644
--- a/tests/role_deploy_domain_controller.pm
+++ b/tests/role_deploy_domain_controller.pm
@@ -34,10 +34,11 @@ sub run {
     assert_script_run "systemctl restart firewalld.service";
     # deploy the server
     my $args = "-U --auto-forwarders --realm=TEST.OPENQA.FEDORAPROJECT.ORG --domain=test.openqa.fedoraproject.org --ds-password=monkeys123 --admin-password=monkeys123 --setup-dns --reverse-zone=2.16.172.in-addr.arpa --allow-zone-overlap";
-    # FIXME: this is a workaround for #1999321 - we just have to turn
-    # off dnssec on the server end to avoid hitting it
+    # FIXME: For upgrades to F>34, we turn off dnssec to avoid hitting
+    # #1999321. For all deployments on F>37, we turn it off to avoid
+    # hitting #2117859
     my $relnum = get_release_number;
-    $args .= ' --no-dnssec-validation' if (get_var("UPGRADE") && $relnum > 34);
+    $args .= ' --no-dnssec-validation' if ($relnum > 37 || (get_var("UPGRADE") && $relnum > 34));
     assert_script_run "ipa-server-install $args", 1200;
     # enable and start the systemd service
     assert_script_run "systemctl enable ipa.service";