You May Want Local DNS Broken Like This
The resolver had the right answer and refused to use it. This is what happens when DNSSEC validation meets split-horizon DNS on a registered domain, and why the solution is a design choice rather than a configuration change.