diff --git a/roles/public_dns/molecule/default/converge.yml b/roles/public_dns/molecule/default/converge.yml
index ddb9eda..7a4c873 100644
--- a/roles/public_dns/molecule/default/converge.yml
+++ b/roles/public_dns/molecule/default/converge.yml
@@ -2,6 +2,13 @@
 - name: Converge
   hosts: all
   gather_facts: true
-
+  vars:
+    public_dns__apply: false          # never call the Gandi API from a container
+    public_dns__domain: example.test
+    public_dns__records:
+      - {record: "@", type: MX, values: ["0 ."], ttl: 3600}
+      - {record: "@", type: TXT, values: ['"v=spf1 -all"'], ttl: 3600}
+    public_dns__absent:
+      - {record: www, type: CNAME}
   roles:
     - role: public_dns
diff --git a/roles/public_dns/molecule/default/verify.yml b/roles/public_dns/molecule/default/verify.yml
index c87d14e..5bbc05a 100644
--- a/roles/public_dns/molecule/default/verify.yml
+++ b/roles/public_dns/molecule/default/verify.yml
@@ -1,11 +1,12 @@
 ---
 - name: Verify
   hosts: all
-  gather_facts: true
-
+  gather_facts: false
   tasks:
-    - name: Add verification tasks here
+    - name: Role variables resolved
       ansible.builtin.assert:
-        that: true
-        msg: "Replace this with real assertions"
+        that:
+          - public_dns__domain == "example.test"
+          - public_dns__apply | bool == false
+        msg: "public_dns defaults/vars did not resolve as expected"
       tags: [verify]