While getting my company setup to use FreeIPA and migrate from the old BIND DNS I have setup a forward zone on our nameservers to point exmaple.net to my FreeIPA servers.  

When I try to do a query from the main DNS resolvers I get the following:
client 10.1.0.66#61548: view internal: query: infra-test-ipa.example.net IN A +E (10.1.6.8)
validating @0x7f686c62c150: infra-test-ipa.example.net A: no valid signature found
  validating @0x7f68640de9a0: example.net SOA: no valid signature found
  validating @0x7f68640dd990: infra-test-ipa.example.net NSEC: no valid signature found
error (no valid RRSIG) resolving 'infra-test-ipa.example.net/DS/IN': 10.1.6.141#53
  validating @0x7f686c69c920: example.net SOA: no valid signature found
  validating @0x7f686c69a280: infra-test-ipa.example.net NSEC: no valid signature found
error (no valid RRSIG) resolving 'infra-test-ipa.example.net/DS/IN': 10.1.6.140#53
error (no valid DS) resolving 'infra-test-ipa.example.net/A/IN': 10.1.6.141#53
validating @0x7f68640c7630: infra-test-ipa.example.net A: no valid signature found
validating @0x7f68640c7630: infra-test-ipa.example.net A: bad cache hit (infra-test-ipa.example.net/DS)

I looked up the error and saw that DNSSEC might be the culprit.  However I checked the resolvers and they say that DNSSEC is not turned on at all:
//dnssec-enable no;
//dnssec-validation no;
//dnssec-lookaside auto;

So just for s&g I installed the DNSSEC portion on my FreeIPA master.

Still getting the same results when doing a dig.

Is there something else I should be doing or should have done?  Can I uninstall the DNSSEC from FreeIPA?

Cheers,
Andrew