Same dig queries for Download.microsoft.com with different results

DiG 9.9.2:

C:\>dig download.microsoft.com @ns1.msft.net

; <<>> DiG 9.9.2 <<>> download.microsoft.com @ns1.msft.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 46932
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;download.microsoft.com.                IN      A

;; Query time: 78 msec
;; SERVER: 2a01:111:2005::1:1#53(2a01:111:2005::1:1)
;; WHEN: Wed Oct 10 03:49:59 2012
;; MSG SIZE  rcvd: 51

DiG 9.3.2:

C:\>dig download.microsoft.com @ns1.msft.net

; <<>> DiG 9.3.2 <<>> download.microsoft.com @ns1.msft.net
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1780
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;download.microsoft.com.                IN      A

;; ANSWER SECTION:
download.microsoft.com. 0       IN      CNAME   download.microsoft.com.nsatc.net.

;; Query time: 93 msec
;; SERVER: 65.55.37.62#53(65.55.37.62)
;; WHEN: Wed Oct 10 03:51:41 2012
;; MSG SIZE  rcvd: 86

Dig command to test if DNSSEC is working

When performing the following dig query, if you get SERVFAIL, then you know DNSSEC validation is working the way it should.

root@ubuntu:~# dig www.dnssec-failed.org @localhost

; <<>> DiG 9.9.1-P3 <<>> www.dnssec-failed.org @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53418
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A

;; Query time: 47 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 4 02:59:20 2012
;; MSG SIZE rcvd: 50

However, if you get NOERROR then something has gone wrong and DNSSEC validation is not working the way it should.

root@ubuntu:~# dig www.dnssec-failed.org @8.8.8.8

; <<>> DiG 9.9.1-P3 <<>> www.dnssec-failed.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43692
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A

;; ANSWER SECTION:
www.dnssec-failed.org. 4750 IN A 69.252.216.215
www.dnssec-failed.org. 4750 IN A 69.252.208.135

;; Query time: 38 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 4 03:00:45 2012
;; MSG SIZE rcvd: 82