systemd-resolved fails to use non-dnssec caches

Upgraded to Kubuntu 17.10 beta 2 today.

On logging in I was unable to connect to any network services. I discovered that any DNS lookups returned SERVFAIL. It seems the caches being used in my university don't support DNSSEC yet and, despite the systemd-resolved man page saying that DNSSEC=allow-downgrade (the default) will allow me to use caches which don't support DNSSEC, I had to explicitly specify DNSSEC=off and restart systemd-resolved.

I can reproduce the bug trivially by changing the /etc/systemd/resolved.conf DNSSEC= setting back to the default and trying a DNS lookup.

:) bduncan@fry:~$ apt-cache policy systemd
systemd:
  Installed: 232-19
  Candidate: 232-19
  Version table:
 *** 232-19 500
        500 http://gb.archive.ubuntu.com/ubuntu zesty/main amd64 Packages
        100 /var/lib/dpkg/status
:) bduncan@fry:~$ lsb_release -rd
Description: Ubuntu Zesty Zapus (development branch)
Release: 17.04

Hope this helps,
Bruce