diff --git a/install/ui/dns.js b/install/ui/dns.js
index 6a684b9ea..0d7f03f20 100644
--- a/install/ui/dns.js
+++ b/install/ui/dns.js
@@ -52,10 +52,19 @@ IPA.dns.config_entity = function(spec) {
                             validators: [IPA.dnsforwarder_validator()]
                         },
                         {
-                            type: 'checkboxes',
+                            type: 'radio',
                             name: 'idnsforwardpolicy',
-                            mutex: true,
-                            options: IPA.create_options(['only', 'first'])
+                            default_value: 'first',
+                            options: [
+                                {
+                                    value: 'first',
+                                    label: IPA.messages.objects.dnsconfig.forward_first
+                                },
+                                {
+                                    value: 'only',
+                                    label: IPA.messages.objects.dnsconfig.forward_only
+                                }
+                            ]
                         },
                         'idnszonerefresh'
                     ]
@@ -170,10 +179,19 @@ IPA.dns.zone_entity = function(spec) {
                         validators: [IPA.dnsforwarder_validator()]
                     },
                     {
-                        type: 'checkboxes',
+                        type: 'radio',
                         name: 'idnsforwardpolicy',
-                        mutex: true,
-                        options: IPA.create_options(['only', 'first'])
+                        default_value: 'first',
+                        options: [
+                            {
+                                value: 'first',
+                                label: IPA.messages.objects.dnsconfig.forward_first
+                            },
+                            {
+                                value: 'only',
+                                label: IPA.messages.objects.dnsconfig.forward_only
+                            }
+                        ]
                     },
                     {
                         type: 'checkbox',
diff --git a/install/ui/ipa.js b/install/ui/ipa.js
index be8748101..eeac03053 100644
--- a/install/ui/ipa.js
+++ b/install/ui/ipa.js
@@ -1516,17 +1516,22 @@ IPA.limit_text = function(value, max_length) {
     return limited_text;
 };
 
-IPA.create_options = function(labels, values) {
-
-    if(!values) values = labels;
+IPA.create_options = function(values) {
 
     var options = [];
 
-    for (var i=0; i<labels.length; i++) {
-        options.push({
-            label: labels[i],
-            value: values[i]
-        });
+    for (var i=0; i<values.length; i++) {
+        var val = values[i];
+        var option = val;
+
+        if (typeof val === 'string') {
+            option = {
+                value: val,
+                label: val
+            };
+        }
+
+        options.push(option);
     }
 
     return options;
diff --git a/install/ui/test/data/ipa_init.json b/install/ui/test/data/ipa_init.json
index 7dc1344d1..7d394f8a3 100644
--- a/install/ui/test/data/ipa_init.json
+++ b/install/ui/test/data/ipa_init.json
@@ -201,6 +201,8 @@
                         },
                         "delegation": {},
                         "dnsconfig": {
+                            "forward_first": "Forward first",
+                            "forward_only": "Forward only",
                             "options": "Options"
                         },
                         "dnsrecord": {
diff --git a/ipalib/plugins/internal.py b/ipalib/plugins/internal.py
index 2f0948aea..66507c887 100644
--- a/ipalib/plugins/internal.py
+++ b/ipalib/plugins/internal.py
@@ -338,6 +338,8 @@ class i18n_messages(Command):
             "delegation": {
             },
             "dnsconfig": {
+                "forward_first": _("Forward first"),
+                "forward_only": _("Forward only"),
                 "options": _("Options"),
             },
             "dnsrecord": {