resolving broken DNSSEC domain with CD flag sometimes returns SERVFAIL
When DNSSEC validation is turned on and I attempt to resolve a broken DNSSEC domain with the CD flag on, kresd should return NOERROR. Instead, it occasionally returns SERVFAIL.
dig rhybar.cz +cd
log.txt: when kresd return SERVFAIL