Check that the time on your system is accurate. Time being off can influence if crypto-related things, like DNSSEC, work or not.
In my case, my DNS server is virtualized and was turned off for about 6 hours. When it came back up, the time was off, and ntp couldn't work because it could resolve ntp.org to sync the time against because DNS wasn't working. Nice chicken-and-egg problem. I manually set the time to be accurate, and named started validating responses and things started working.
This page is the one that lead me to checking the system time:
http://spectlog.com/content/BIND_nam....com/A/IN'