Description of problem:
ED25519 and ED448 are not enabled in FIPS mode and their validation fails. That is known and wanted by crypto policy. But that means resolution of any DNSSEC signed name with such algorithm would fail.

It should make those algorithms disabled in policy, which would make those names just insecure, just as we want it.

Version-Release number of selected component (if applicable):
crypto-policies-20220404-1.git845c0c1.el9.noarch
bind-9.16.23-1.el9.x86_64


How reproducible:
reliable

Steps to Reproduce:
1. dnf install bind bind-utils
2. (configure forwaders { $IP; }; in options {})
3. systemctl restart named
4. dig @localhost secure.d4a{15,16}n3.rootcanary.net.

Actual results:
; <<>> DiG 9.16.23-RH <<>> @localhost secure.d4a15n3.rootcanary.net. secure.d4a16n3.rootcanary.net.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 28355
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ab461e6ec219ea0d010000006262b254198c1f2b77f1b21c (good)
;; QUESTION SECTION:
;secure.d4a15n3.rootcanary.net.	IN	A

;; Query time: 10 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Apr 22 09:49:08 EDT 2022
;; MSG SIZE  rcvd: 86

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56007
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: ab461e6ec219ea0d010000006262b25568c38359197f6a65 (good)
;; QUESTION SECTION:
;secure.d4a16n3.rootcanary.net.	IN	A

;; Query time: 269 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Apr 22 09:49:09 EDT 2022
;; MSG SIZE  rcvd: 86


Expected results:

; <<>> DiG 9.16.23-RH <<>> @localhost secure.d4a15n3.rootcanary.net. secure.d4a16n3.rootcanary.net.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15303
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 84d8c487c3786ef8010000006262b1542452404818e7bd73 (good)
;; QUESTION SECTION:
;secure.d4a15n3.rootcanary.net.	IN	A

;; ANSWER SECTION:
secure.d4a15n3.rootcanary.net. 60 IN	A	145.97.20.20

;; Query time: 270 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Apr 22 09:44:52 EDT 2022
;; MSG SIZE  rcvd: 102

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62712
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 84d8c487c3786ef8010000006262b1542452404818e7bd73 (good)
;; QUESTION SECTION:
;secure.d4a16n3.rootcanary.net.	IN	A

;; ANSWER SECTION:
secure.d4a16n3.rootcanary.net. 60 IN	A	145.97.20.20

;; Query time: 178 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Apr 22 09:44:52 EDT 2022
;; MSG SIZE  rcvd: 102


Additional info:
I fixed it with following bind.config:

disable-algorithms "." {
RSAMD5;
RSASHA1;
NSEC3RSASHA1;
DSA;
ED25519;
ED448;
};
disable-ds-digests "." {
SHA-1;
GOST;
};