> ; <<>> DiG 9.8.1-P1 <<>> +cd @8.8.8.8 a
> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net

<snip rest of NOERROR response>

>
> But a query for DS on the same domain, which is what dnsmasq does next,
> returns SERVFAIL, _even_with_ checking disabled.
>
> ; <<>> DiG 9.8.1-P1 <<>> +cd @8.8.8.8 ds
> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net

<snip SERVFAIL response>

This looks identical to the *.cloudflare.com issue I had last week.  In
both cases, using Level 3's 4.2.2.2 instead of Google DNS works fine,
and 8.8.8.8 returns SERVFAIL for DS lookups.  This looks like a bug in
Google's DNS servers as opposed to dnsmasq...