diff --git a/modules/dns/main.tf b/modules/dns/main.tf
index 669c143323..7547cec13c 100644
--- a/modules/dns/main.tf
+++ b/modules/dns/main.tf
@@ -158,7 +158,7 @@ resource "google_dns_managed_zone_iam_binding" "iam_bindings" {
 }
 
 data "google_dns_keys" "dns_keys" {
-  count        = try(var.zone_config.public.dnssec_config, null) != null ? 1 : 0
+  count        = try(var.zone_config.public.dnssec_config.state, "off") != "off" ? 1 : 0
   managed_zone = local.managed_zone.id
   project      = var.project_id
 }