validate resolver

First of all, change the /etc/named.conf

option {
  ...
  dnssec-enable yes;
  dnssec-validation yes;
  ...
};

as the name suggests, it will enable first the dnssec request/response, and then the security validator in BIND 9.X