It appears that the DNS stub is NOT returning the RRSIG record when requesting DNSSEC.
$ dig cloudflare-dns.com. AAAA +dnssec
See https://circleci.com/gh/richardschneider/net-udns/209 for more details.
Expected
; <<>> DiG 9.9.5-3ubuntu0.15-Ubuntu <<>> cloudflare-dns.com. AAAA +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46237
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;cloudflare-dns.com. IN AAAA
;; ANSWER SECTION:
cloudflare-dns.com. 299 IN AAAA 2400:cb00:2048:1::6810:7019
cloudflare-dns.com. 299 IN AAAA 2400:cb00:2048:1::6810:6f19
cloudflare-dns.com. 299 IN RRSIG AAAA 13 2 300 20180829083845 20180827063845 35273 cloudflare-dns.com. 1JGEZHTmEWLa/NSSlsYrw9xwTJKNbVSpI0C9kSI4n0yaXPmHWIgPHeOV lQbGj/G+3KHy6e0tcQHMQ+hTEx0SEw==
Actual
; <<>> DiG 9.9.5-9+deb8u15-Debian <<>> cloudflare-dns.com. AAAA +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25802
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;cloudflare-dns.com. IN AAAA
;; ANSWER SECTION:
cloudflare-dns.com. 60 IN AAAA 2400:cb00:2048:1::6810:6f19
cloudflare-dns.com. 60 IN AAAA 2400:cb00:2048:1::6810:7019