DNSSEC broken in Windows 2016's DNS server?

Question

I'm currently in the process of migrating a DNS server from Windows 2012 R2 to Windows 2016. However, I have run into an issue with DNSSEC. So far I have just moved one domain, an unused test domain, from the Win2012 server to the Win2016 server, and I am getting DNSSEC validation errors on just about every DNSSEC validation tool I have tested ("No RRSIGs found", "Nameserver does not do DNSSEC extra processing.", "No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone.", etc)

On the Win2012 box, the DNS server config dialog has an option "Enable DNSSEC validation for remote responses":

The same option is missing on Windows 2016:

Help, what's going on here?

Apparently, others have run into the same issue, here are two other discussions I found when googling this problem: http://webcache.googleusercontent.com/search?q=cache:fEdkPUHEA40J:lists.cloudapp.net/pipermail/windns-users/2016-July/000133.html+&cd=2&hl=en&ct=clnk https://social.technet.microsoft.com/Forums/en-US/34e0d2b2-438b-4116-9329-78ecc1e1d550/dnssec-validation-fail-in-windows-server-2016

Update: after a bit of googling, I found this article:

http://info.menandmice.com/blog/bid/88297/Windows-2012-Server-Enabling-DNSSEC-validation

...which has a command line option for enabling DNSSEC:

DnsCmd.exe  /Config /enablednssec 1

...and that solved it for me.

Solution

The solution , found at http://info.menandmice.com/blog/bid/88297/Windows-2012-Server-Enabling-DNSSEC-validation, was to run:

DnsCmd.exe /Config /enablednssec 1

Comments

[Calle Dybedahl]

The error messages you quote talk about problems with the responses your server sends to others. The option you're missing talks about your machine validating responses it gets from other servers. Those are very different things. Maybe you need to look for a different option to activate on your server?

[mehdi.loa]

I think it is controlled by the same setting. That said, although it is not visible in the DNS server GUI, it can be enabled from the command line. (See my update above)