Comment by joveian

I don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.