NS as referrals even if the NS records are in the
answer section, because BIND 8 servers incorrectly
send them that way. This is necessary for DNSSEC
validation of the NS records of a secure zone to
succeed when the parent is a BIND 8 server. [RT #1706]