配置 dnssec 后 dig 不提供 AD-bit

Question

我正在这Deterlab 练习，我在将 DNSSEC 添加到 Bind 时遇到了一些问题。服务器运行 BIND 9.7.0-P1。我所做的配置如下：google.com 的签名区域：

zonesigner -genkeys google.com

在文件下为 google.com 添加了 .signed 到 named.conf.local。

添加到named.conf.options：

dnssec-enabled yes; 
dnssec-validation yes;

添加到named.conf：

include "/etc/bind/bind.keys";

使用bind.keys：

trusted-keys {
    . 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
    FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
    bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
    X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
    W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
    Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
    QxA+Uk1ihz0=";
};

所有文件都可以通过 named-checkconf 顺利编译。当我重新启动 bind 并运行 dig 时，我仍然没有得到 AD 位：

sudo dig +dnssec www.google.com A
; <<>> DiG 9.7.0-P1 <<>> +dnssec www.google.com A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20641
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.google.com.            IN  A

;; ANSWER SECTION:
www.google.com.     10  IN  A   10.1.2.155
www.google.com.     10  IN  RRSIG   A 5 3 10 20160512120048 20160412120048 34206 google.com. QPVwvcsE5VXvMxnhS8/7LDwBWoTopQAuFPaRBeOSlARwTJkuReNgmqoL GcDD++zgS536YlrLGqAr+06fl2fnnnxtfwZUu6pwVmeosnmsU8b3Jd+b domXH138Ob1cBuS7Z5KDI94LkBfTu0ksFEBfcs7lCtvyY9zMw7BWhQ2L lnU=

;; AUTHORITY SECTION:
google.com.     604800  IN  NS  ns.google.com.
google.com.     604800  IN  RRSIG   NS 5 2 604800 20160512120048 20160412120048 34206 google.com. qnx8xI4qYfGBZ3GygxdCrgdoA7x8YwlYYVWPOntQax6Jzhof0V8FgQR6 FqXVVyOeA9aapVimYh45tI42WJ2DyNc8GgCX3xKwPdlmf3zrQqRKcr9F L/6tlLu+ZjBxPbQamLXueXM6m9eFSp9OMqj4EqDCCCA3fzXCkakQyv6P uIw=

;; ADDITIONAL SECTION:
ns.google.com.      10  IN  A   10.1.2.3
ns.google.com.      10  IN  RRSIG   A 5 3 10 20160512120048 20160412120048 34206 google.com. ajOz8/kjZ0DWJRGqGQL9TEvBFEhU5PUm1jYXjXzjJy5vHFj4EveZP39U FOtwIQMsyeHpPeW1KDicwMrpn6Dm/GKVK74HVPym9HJhTpL757K67BA+ dHMzySfMKt0qKyeUVkskZ0Tu6DJKjgB8De9ti6hHNrrh89r3lxg1b7r5 B/o=

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Apr 12 07:13:18 2016
;; MSG SIZE  rcvd: 602

为了获得完全验证的响应，我需要进行什么更改，即 AD 位设置？