Test for www.nicmexico.mx. AD flag
Test with real world Internet data: Our attempt to resolve www.nic.mx A leads to CNAME www.nicmexico.mx. Sub-tree nic.mx is not signed and nixmexico.mx is signed. The answer must not have AD flag set! The first resolution process may polute cache with insecure records. Verify that answer for www.nicmexico.mx A has AD bit set!