dnssec-enable is not really global
if one enables dnssec in the 'zones' section, but lists some zone before 'dnssec-enable on', those zones will not have DNSSEC enabled.
if one enables dnssec in the 'zones' section, but lists some zone before 'dnssec-enable on', those zones will not have DNSSEC enabled.