On 2013-05-29 at 14:10 +1000, other@??? wrote:
> I guess the local caching nameserver is one way out of this, an
> overkill one, but an option... I was really hoping to avoid it if I can.
Install unbound. It's simple to set up and configure and it's very
simple to enable DNSSEC validation, should you choose to do so.
http://www.unbound.net/
-Phil