proper setup of dnssec-validation to _always_ resolve, and retrieve DATA and status flags ?

[dchilton+bind at bestmail.us]

Hi,

On Tue, 10 May 2011 13:52 +1000, "Mark Andrews" <marka at isc.org> wrote:
> 
> 	This sounds like you have configured 'must-be-secure ".";' which
> 	disables secure to insecure transitions within the must-be-secure
> 	namespace.
> 

I'd not yet heard of that option.  It's not present in my named.conf at
all.  Reading e.g. here,
https://lists.isc.org/pipermail/bind-users/2004-July/051274.html, iiuc
it doesn't seem to default to enabled.

DCh