subdomain of the query domain, tell the ADB to start looking at "." if
it doesn't know the address.  This keeps us from getting stuck if the
nameserver is beneath the zone cut and we don't know its address
(e.g. because the A record has expired).  By restarting from ".", we
ensure that any missing glue will be reestablished.

Misc. DNSSEC validation groundwork.