No DNSSEC when FORWARD policy enabled

It was discovered that the documentation for FORWARD policy missed the information about DNSSEC validation. The query policies are only applied on inbound queries and therefore the full DNSSEC validation is disabled when Knot Resolver operates in FORWARD mode, and relies on DNSSEC validation from upstream resolver.

As a workaround, you can either:

Example configuration:

-- Use IPv6 CZ.NIC Open DNSSEC Validating Resolvers
-- Use IPv4 CZ.NIC Open DNSSEC Validating Resolvers

For the full list of Knot Resolver features, please see the online documentation.