Simplest solution is just to check if the resolver set the AD bit in the response in our `LookupCAA` function.