DNSSEC problems

[Matthias Scheler <tron%zhadum.org.uk@localhost>]

        Hello,

I'm using BIND 9.7.2-P3 built from "netbsd-5" sources on a NetBSD 5.1 system.
I recently enable DNSSEC after it was turned on by default in the
"named.conf" that is shipped with NetBSD. It worked fine for several days
until this morning. At this point my server was refusing to resolve a lot
of domains e.g. "apple.com" or "spiegel.de". Here are some of the
error messages:

Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'kliniksuche.spiegel.de/AAAA/IN': 2001:8b0::2021#53
Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'kliniksuche.spiegel.de/A/IN': 2001:8b0::2021#53
Jan 22 09:32:42 colwyn named[9658]:   validating @0x7f7ff6be2000: dlv.isc.org 
SOA: got insecure response; parent indicates it should be secure
Jan 22 09:32:42 colwyn named[9658]: validating @0x7f7ff6be1000: 
www.dastelefonbuch.de.dlv.isc.org DLV: bad cache hit (de.dlv.isc.org/DS)
Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'www.dastelefonbuch.de.dlv.isc.org/DLV/IN': 2001:8b0::2021#53
Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'www.dastelefonbuch.de/A/IN': 2001:8b0::2021#53
Jan 22 09:32:42 colwyn named[9658]:   validating @0x7f7ff69e5000: dlv.isc.org 
SOA: got insecure response; parent indicates it should be secure
Jan 22 09:32:42 colwyn named[9658]: validating @0x7f7ff69e4000: 
dastelefonbuch.de.dlv.isc.org DLV: bad cache hit (de.dlv.isc.org/DS)
Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'dastelefonbuch.de.dlv.isc.org/DLV/IN': 2001:8b0::2021#53
Jan 22 09:32:42 colwyn named[9658]: error (broken trust chain) resolving 
'www.dastelefonbuch.de/AAAA/IN': 2001:8b0::2021#53

Any idea what is going wrong here? 2001:8b0::2021 is one of the recursive
resolves provided by my ISP.

        Kind regards

-- 
Matthias Scheler                                  http://zhadum.org.uk/