Useful discussion on Xitter about how to check if your BIP-353 DNS records have DNSSEC setup correctly:
Almost there! You must enable DNSSEC on your domain.
This should contain "AD":true
Discussion
oops, missing example link: https://dns.google/query?name=ben.user._bitcoin-payment.btcsessions.ca&rr_type=TXT&ecs=
You can also now use https://satsto.me which should give reasonable error messages (currently says “The server indicated the records we needed were not DNSSEC-authenticated” for the example name you gave).