When the ARES_FLAG_DNSSEC is specified, use the nameservers that are tagged as trusted.