Configure bind to be a caching resolver

[petersconsult]

Hello all,

Following up on an old post i made here in 2022, i'm having trouble setting up bind to be a caching resolver..

Here's what i did:

in the file etc/named.conf i changed:

recursion yes

and added

allow-query-cache { localhost; localnets; };
allow-recursion { localhost; localnets; };

then restarted named but when i do

dig google.com @127.0.0.1

i get a SERVFAIL error and the log shows a bunch of these errors:

validating com/DS: no valid signature found
no valid RRSIG resolving 'com/DS/IN'

i then tried adding:

forwarders {
        10.254.254.251;
        8.8.8.8;
        };
    forward first;

and changed

dnssec-validation auto;

But nothing's working..
the interwebs points to a DNSSEC issue, but i just can't figure it out..

This is under AlmaLinux 9, by the way..

i would greatly appreciate any help!
Thank You!