Unfortunately, you can do everything right and still not be able to connect, as modern DNSSEC sees the DNS redirection that private servers do as a malicious man-in-the-middle DNS attack. As DNSSEC rolls out more, chances are changing the DNS server will work for nobody as ISP routing will always ...