GTM can sign a DNS response using DNSSEC only if the DNS request ?GTM can sign a DNS response using DNSSEC only if the DNS request

There is no 'S-bit' in standard DNS request headers; the relevant optional signal is the DO (DNSSEC OK) bit in the EDNS0 OPT record, and even that is not the condition that governs whether GTM signs a response.

DNSSEC signing is a zone-level function; the GTM can cryptographically sign responses only for queries that fall within a zone that has DNSSEC enabled and has signing keys configured. Zone membership is the controlling condition because the signing keys and chain of trust are established per zone, not per individual record or request flag.

A name being configured as a WideIP on the GTM alone does not enable DNSSEC signing; the zone containing that name must separately have DNSSEC enabled with valid signing keys.

BIND running on the GTM is not a prerequisite for DNSSEC signing; GTM's native DNS and DNS Express features can handle DNSSEC independently of which process answers the query.