Test with real world Internet data:
Our attempt to resolve www.nic.mx A leads to CNAME www.nicmexico.mx.
Sub-tree nic.mx is not signed and nixmexico.mx is signed.
The answer must not have AD flag set!