Comment # 2 on bug 1212115 from Jorik Cronenberg

Try setting the following in your named.conf
> dnssec-enable yes;
> dnssec-validation yes;