Hello.
You seem to be hitting quite a common stumbling point - you see:
On 5/23/19 3:10 AM, B. Cook wrote:
[cach] => NSEC sname: covered by: pccw. ->
pe., new TTL 83379
i.e. kresd has a record from the root zone proving that there's no .pcsd
TLD, so it answers NXDOMAIN. Usually it doesn't get such a record at
start, and it might obtain a positive record that takes precedence, too,
so it's easy to get confused... combining contradictory records is just
tricky. I expect you can configure these particular TLD names - see
docs for details:
https://knot-resolver.readthedocs.io/en/latest/modules.html#replacing-part-…
--Vladimir