no valid signature found - but where do the queries come from?

[lejeczek]

hi users,

I'm getting lot of below in log:

validating @0x7f53140149a0:
ccnr-winsrv1.xxx.private.other.dom.my.dom A: bad cache hit
(uk.my.dom/DS)
validating @0x7f5314015630:
ccnr-winsrv1.xxx.private.other.dom.my.dom AAAA: bad cache
hit (uk.my.dom/DS)
error (broken trust chain) resolving
'ccnr-winsrv1.xxx.private.other.dom.my.dom/A/IN':
192.168.2.100#53
error (broken trust chain) resolving
'ccnr-winsrv1.xxx.private.other.dom.my.dom/AAAA/IN':
192.168.2.100#53
validating @0x7f52e4002650: my.dom SOA: no valid
signature found
validating @0x7f52e40032e0: my.dom SOA: no valid
signature found
validating @0x7f52e4002650: my.dom NSEC: no valid
signature found
validating @0x7f52e40032e0: my.dom NSEC: no valid
signature found
validating @0x7f52e4002650: swir.my.dom NSEC: no valid
signature found
validating @0x7f52e4002650: swir.my.dom NSEC: bad cache
hit (swir.my.dom/DS)
validating @0x7f52e40032e0: swir.my.dom NSEC: no valid
signature found
validating @0x7f52e40032e0: swir.my.dom NSEC: bad cache
hit (swir.my.dom/DS)
validating @0x7f52e40016c0:
ccnr-winsrv1.xxx.private.other.dom.my.dom AAAA: bad cache
hit (uk.my.dom/DS)
validating @0x7f52e40008c0:
ccnr-winsrv1.xxx.private.other.dom.my.dom A: bad cache hit
(uk.my.dom/DS)
error (broken trust chain) resolving
'ccnr-winsrv1.xxx.private.other.dom.my.dom/AAAA/IN':
192.168.2.100#53
error (broken trust chain) resolving
'ccnr-winsrv1.xxx.private.other.dom.my.dom/A/IN':
192.168.2.100#53

it's on a server - serverB.xxx.private.other.com(9.9.4) -
which forwards zone my.dom to serverA.my.dom (9.8.2rc1)

serverB is insecure whereas serverA.my.dom uses dnssec.

Firstly I'm hoping some experts could shed a bit light on
what's happening with that frequency these get logged, every
few seconds. Is it the dns itself of clients are actually
nag the server so constantly - how to trace it? - trace 6
and I cannot see anything.

Secondly, it must be configuration I thing, though I think
it was ok some time ago, now - on serverB I do:

$ host swir.my.dom. 127.0.0.1 -vv
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

Host swir.my.dom not found: 2(SERVFAIL)

further I do:

$ dig +qr my.dom.

and nothing, then:

$ dig +qr my.dom. @192.168.2.100 (which is serverA)

and I see NS, A, also that from log a line:

validating @0x7f52e40016c0:
ccnr-winsrv1.xxx.private.other.dom.my.dom AAAA: bad cache
hit (uk.my.dom/DS)

here is my.dom(serverA) appended to
private.other.dom(serverB) - what does it mean?

how, where to start troubleshooting?

many! thanks