A branch resolver forwards a private suffix correctly and DNSSEC failures...

The zone is forwarded to the right resolver, yet validation changes because the path now skips the local resolver that knew the upstream exception.