>From my signed domain when I query www.isc.org (w/ +dnssec) I get the ad flag as expected. I don't see that flag when I query whitehouse.gov (w/ +dnssec) and I know that zone is signed. Is anyone else seeing this behavior? Also, is there a link that addresses troubleshooting or diagnosing DNSSEC based queries? TIA