On 0.24.1, setting validate=true rejects domains that do not publish DNSSEC records

[msrd0]

Describe the bug
I would expect that when I ask hickory-dns to validate DNSSEC, it only rejects those that failed validation (i.e. have bogus DNSSEC records), not also those that do not publish DNSSEC to begin with. For extremely paranoid ppl it might make sense to add an additional option, but I believe the default should be "check whenever possible".

To Reproduce
Start hickory-dns with the following config:

listen_port = 53
listen_addrs_ipv4 = ["127.0.0.1"]
listen_addrs_ipv6 = ["::1"]

[[zones]]
zone = "."
zone_type = "Forward"

[zones.stores]
type = "forward"

[zones.stores.options]
validate = true

[[zones.stores.name_servers]]
socket_addr = "1.1.1.1:853"
protocol = "tls"
tls_dns_name = "cloudflare-dns.com"
trust_nx_responses = false

[[zones.stores.name_servers]]
socket_addr = "1.0.0.1:853"
protocol = "tls"
tls_dns_name = "cloudflare-dns.com"
trust_nx_responses = false

Then, query any domain that does not publish DNSSEC records, e.g. github.com. Observe that no error indicator and no records are returned.

Expected behavior
I expect to receive the records of the domain I queried.

System:

• OS: I use arch btw
• Architecture: x86_64
• Version: Linux 6.10.7-arch1-1
• rustc version: 1.80.1 (376290515 2024-07-16)

Version:
Crate: hickory-dns binary
Version: 0.24.1

[djc]

I don't think there will be any more development of the 0.24.x range, so I suggest we focus discussion on #2428.

[djc]

Closing this for the stated reason.