diff --git a/modules/dns/main.tf b/modules/dns/main.tf
index 8957b970..738794c2 100644
--- a/modules/dns/main.tf
+++ b/modules/dns/main.tf
@@ -115,7 +115,7 @@ resource "google_dns_managed_zone" "public" {
   visibility  = "public"
 
   dynamic "dnssec_config" {
-    for_each = var.dnssec_config == {} ? [] : list(var.dnssec_config)
+    for_each = var.dnssec_config == {} ? [] : tolist([var.dnssec_config])
     iterator = config
     content {
       kind          = lookup(config.value, "kind", "dns#managedZoneDnsSecConfig")