Hello,
we have configured the UTM (9.355-1) DNS according to "DNS best practice" by Bob Alfson and KB https://www.sophos.com/de-de/support/knowledgebase/120283.aspx .
The DNSSEC option in the UTM DNS Proxy/Forwarder is on and did not give us problems…