without DNSSEC validation. [RT #20737] 9.4-ESV, 9.5.3, 9.6.2, 9.7.0, 9.8.0(?)
the additional section or not and only return it if validates as secure. [RT #20438]