apt-get install -y bind9 bind9-utils

Out of the box I discovered an error logged to syslog and all lookups failed :

managed-keys-zone: Unable to fetch DNSKEY set '.': timed out

The default location for the "bind.keys" file is "/etc/bind.keys", but the package
locates that file as "/etc/bind/bind.keys".  As such it was necessary to specify the
current file location by editing the "/etc/bind/named.conf.options" config :

vi /etc/bind/named.conf.options

such that :

dnssec-validation auto;
bindkeys-file "/etc/bind/bind.keys";

And, after saving, remove the (likely junked) cache file and journal :

rm /var/cache/bind/managed-keys.bind*

Restart bind and my caching server is now usable.

--K