Strange. My bind is not validating dnssec even though I configured it to. Version according to
named -V is
BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key.
Under options in named.conf
dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto;
But when I query a known bad zone, like doing
dig www.dnssec-failed.org @localhost I get IP addresses- not a failure like I was expecting. Any thoughts?