Bind 9 DNSSEC验证未按预期返回SERVFAIL问题排查求助

大家好，我在AlmaLinux 9.1上安装了Bind 9.11.36，遇到了DNSSEC验证不符合预期的问题，想请各位帮忙看看哪里出了问题。

按照预期，查询www.dnssec-failed.org应该因为DNSSEC验证失败而返回SERVFAIL，并且不会给出解析结果。但实际测试下来，虽然查询结果确实没有AD标志，却没有触发SERVFAIL，反而正常返回了IP地址。

我用的查询命令是：

dig www.dnssec-failed.org @127.0.0.1

Bind日志里明确显示：

validating www.dnssec-failed.org/A: no valid signature found

但dig的输出结果却是这样的：

; <<>> DiG 9.16.23-RH <<>> www.dnssec-failed.org. @127.0.0.1 A

;; global options: +cmd

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50810
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 0a21031e4e1f7243010000006424706502d5d67190cfe7eb (good)

;; QUESTION SECTION:
;www.dnssec-failed.org.         IN      A

;; ANSWER SECTION:
www.dnssec-failed.org.  5489    IN      A       69.252.193.191
www.dnssec-failed.org.  5489    IN      A       68.87.109.242

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Mar 29 10:07:49 PDT 2023
;; MSG SIZE  rcvd: 110

用nslookup测试的结果也一样：

nslookup www.dnssec-failed.org
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.dnssec-failed.org
Address: 69.252.193.191
Name: www.dnssec-failed.org
Address: 68.87.109.242

我的named.conf配置比较简单，内容如下：

options {
listen-on port 53 { 127.0.0.1; 192.168.9.82; 10.1.2.35; 216.151.2.125; };
directory       "/var/named";
datasize        10G;
max-cache-size  10G;
dump-file       "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file   "/var/named/data/named.secroots";
recursing-file  "/var/named/data/named.recursing";
allow-query     { localhost; 192.168.9.0/24; 10.1.2.0/24; 216.151.2.96/27; };
recursion yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
geoip-directory "/usr/share/GeoIP";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
category lame-servers {null;};
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

想请教各位，接下来我应该从哪些方面入手排查这个问题呢？感谢大家的帮助！

备注：内容来源于stack exchange，提问作者user2293165