Secure Name Resolution with BIND9

Stub resolver send recursive query to caching server
with AD flag ON

Caching server performs name resolution
verifying RRSIGs
starting a security root defined in the config

On success
Return a response as a normal response
When validation fails
Return SERVFAIL