Install and set up your nameserver (bind9 package) normally, and then just add the following stanza to /etc/bind/named.conf.options:

managed-keys {

  "." initial-key 257 3 8

    "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF

     FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX

     bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD

     X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz

     W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS

     Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq

     QxA+Uk1ihz0=";

};

Then restart the service (sudo service bind9 restart).

To make sure it is working, try to resolve "www.dnssec-failed.org", it should fail:

$ host www.dnssec-failed.org

Host www.dnssec-failed.org not found: 3(NXDOMAIN)

If it gives an IP address, then DNSSEC validation is not working.