I was trying to verify DNSSEC on RHEL 6 server and it does not work with suggested configuration in /etc/named.conf:

options {
   ...
   dnssec-enable yes;
   dnssec-validation yes;
   dnssec-lookaside auto;"
   bindkeys-file "/etc/named.iscdlv.key";
}

The configuration above does not return "ad" flag by: dig +dnssec www.nic.cz

However, I found that using the include directive (outside of options) works, so it looks like:

options {
   ...
   dnssec-enable yes;
   dnssec-validation yes;
   dnssec-lookaside auto;"
   bindkeys-file "/etc/named.iscdlv.key";
}
include "/etc/named.root.key";

This report is only for FYI, not meant as real bugreport.
The proper include directive is in default configuration file of RHEL6 too.