Description of problem:
RFE -  bind package to include features of ISC BIND (BIND 9.11)

Version-Release number of selected component (if applicable):
bind-9.9.4-38.el7_3.3.x86_64

Business justification on this in Customer's words -
~~~
The business justification is mainly security/compliance related. As stated in Case 01183581, our security regulations require us to enable DNSSEC validation in our DNS resolvers.
However, the BIND versions in RedHat can only enable DNSSEC validation on a global level (for all queries - without exceptions). Unfortunately, some of our customer's internal domains will fail dnssec validation, because they use dns names that are not registered officially. Since we need access to these domains, we currently can not enable DNSSEC validation on our resolvers :(

The current bind911 version has more fine grained DNSSEC validation features, called "negative trust anchors" (see IETF RFC 7646). This would enable us to use finally enable DNSSEC for all queries, while we can still disable DNSSEC validation for specific domains known to be failing validation due to administrative error rather than because of a spoofing attack.

The new bind version would help us comply with our (and our customer's) compliance regulations and significantly raise the security level of the whole corporate network.
~~~

Additional info:
rpm -q bind --changelog  <--Doesnt show that "RFC 7646" is included in RHEL7 bind package

see IETF RFC 7646  --> https://tools.ietf.org/html/rfc7646