BIND SERVFAIL on common domains, restarting BIND resolves the issue

From time to time by BIND 9 fails with SERVFAIL on pretty much every query. What’s weird is that restarting BIND helps.

I turned on debugging and get this in logs:

24-Dec-2018 15:32:58.790 lame-servers: info: broken trust chain resolving 'github.com/AAAA/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.790 query-errors: debug 1: client 10.0.1.163#45403 (github.com): query failed (SERVFAIL) for github.com/IN/AAAA at ../../../bin/named/query.c:7773 24-Dec-2018 15:32:58.900 resolver: debug 1: fetch: bitbucket.org/A 24-Dec-2018 15:32:58.900 resolver: debug 1: fetch: bitbucket.org/AAAA 24-Dec-2018 15:32:58.906 database: debug 1: decrement_reference: delete from rbt: 0x7fb568a19e80 bitbucket.org 24-Dec-2018 15:32:58.906 resolver: debug 1: fetch: bitbucket.org/DS 24-Dec-2018 15:32:58.907 database: debug 1: decrement_reference: delete from rbt: 0x7fb568a19e80 bitbucket.org 24-Dec-2018 15:32:58.907 resolver: debug 1: fetch: bitbucket.org/DS 24-Dec-2018 15:32:58.919 dnssec: info:   validating org/SOA: got insecure response; parent indicates it should be secure 24-Dec-2018 15:32:58.919 lame-servers: info: no valid RRSIG resolving 'bitbucket.org/DS/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.928 resolver: debug 1: fetch: org/DNSKEY 24-Dec-2018 15:32:58.935 dnssec: info: validating org/DNSKEY: got insecure response; parent indicates it should be secure 24-Dec-2018 15:32:58.935 lame-servers: info: insecurity proof failed resolving 'org/DNSKEY/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.947 resolver: debug 1: fetch: bitbucket.org.dlv.isc.org/DLV 24-Dec-2018 15:32:58.947 resolver: debug 1: fetch: bitbucket.org.dlv.isc.org/DLV 24-Dec-2018 15:32:58.986 dnssec: info:   validating dlv.isc.org/SOA: got insecure response; parent indicates it should be secure 24-Dec-2018 15:32:58.986 dnssec: info: validating bitbucket.org.dlv.isc.org/DLV: bad cache hit (org.dlv.isc.org/DS) 24-Dec-2018 15:32:58.986 lame-servers: info: broken trust chain resolving 'bitbucket.org.dlv.isc.org/DLV/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.986 lame-servers: info: broken trust chain resolving 'bitbucket.org/A/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.986 lame-servers: info: broken trust chain resolving 'bitbucket.org/AAAA/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.986 query-errors: debug 1: client 10.0.1.163#54539 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/A at ../../../bin/named/query.c:7773 24-Dec-2018 15:32:58.986 query-errors: debug 1: client 10.0.1.163#54539 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/AAAA at ../../../bin/named/query.c:7773 24-Dec-2018 15:32:58.987 resolver: debug 1: fetch: bitbucket.org/A 24-Dec-2018 15:32:58.987 resolver: debug 1: fetch: bitbucket.org/AAAA 24-Dec-2018 15:32:58.993 dnssec: info: validating bitbucket.org/A: bad cache hit (bitbucket.org.dlv.isc.org/DLV) 24-Dec-2018 15:32:58.993 lame-servers: info: broken trust chain resolving 'bitbucket.org/A/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.993 query-errors: debug 1: client 10.0.1.163#54539 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/A at ../../../bin/named/query.c:7773 24-Dec-2018 15:32:58.994 dnssec: info: validating bitbucket.org/AAAA: bad cache hit (bitbucket.org.dlv.isc.org/DLV) 24-Dec-2018 15:32:58.994 lame-servers: info: broken trust chain resolving 'bitbucket.org/AAAA/IN': 1.2.3.4#53 24-Dec-2018 15:32:58.994 query-errors: debug 1: client 10.0.1.163#54539 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/AAAA at ../../../bin/named/query.c:7773 24-Dec-2018 15:33:23.774 resolver: debug 1: fetch: 43.249.96.191.in-addr.arpa/PTR 24-Dec-2018 15:33:23.780 resolver: debug 1: fetch: 249.96.191.in-addr.arpa.dlv.isc.org/DLV -- 24-Dec-2018 15:33:33.502 lame-servers: info: broken trust chain resolving '170.81.36.185.in-addr.arpa/PTR/IN': 1.2.3.4#53 24-Dec-2018 15:33:33.502 query-errors: debug 1: client 10.5.1.181#58654 (170.81.36.185.in-addr.arpa): query failed (SERVFAIL) for 170.81.36.185.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:7773 24-Dec-2018 15:33:35.271 resolver: debug 1: fetch: bitbucket.org/A 24-Dec-2018 15:33:35.286 dnssec: info: validating bitbucket.org/A: bad cache hit (bitbucket.org.dlv.isc.org/DLV) 24-Dec-2018 15:33:35.286 lame-servers: info: broken trust chain resolving 'bitbucket.org/A/IN': 1.2.3.4#53 24-Dec-2018 15:33:35.286 query-errors: debug 1: client 10.0.1.163#59171 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/A at ../../../bin/named/query.c:7773 24-Dec-2018 15:33:51.394 resolver: debug 1: fetch: 118.120.54.92.in-addr.arpa/PTR 24-Dec-2018 15:33:51.401 database: debug 1: decrement_reference: delete from rbt: 0x7fb50b313268 118.120.54.92.in-addr.arpa -- 24-Dec-2018 15:33:56.771 lame-servers: info: broken trust chain resolving '1.debian.pool.ntp.org/AAAA/IN': 1.2.3.4#53 24-Dec-2018 15:33:56.771 query-errors: debug 1: client 10.0.1.163#59947 (1.debian.pool.ntp.org): query failed (SERVFAIL) for 1.debian.pool.ntp.org/IN/AAAA at ../../../bin/named/query.c:7773 24-Dec-2018 15:34:02.364 resolver: debug 1: fetch: bitbucket.org/A 24-Dec-2018 15:34:02.371 dnssec: info: validating bitbucket.org/A: bad cache hit (bitbucket.org.dlv.isc.org/DLV) 24-Dec-2018 15:34:02.371 lame-servers: info: broken trust chain resolving 'bitbucket.org/A/IN': 1.2.3.4#53 24-Dec-2018 15:34:02.371 query-errors: debug 1: client 10.0.1.90#39850 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/A at ../../../bin/named/query.c:7773 24-Dec-2018 15:34:02.751 resolver: debug 1: fetch: 159.47.143.90.in-addr.arpa/PTR 24-Dec-2018 15:34:02.896 database: debug 1: decrement_reference: delete from rbt: 0x7fb50b313268 159.47.143.90.in-addr.arpa -- 24-Dec-2018 15:34:03.927 resolver: debug 1: fetch: 159.47.143.90.xbl.spamhaus.org/TXT 24-Dec-2018 15:34:15.106 resolver: debug 1: fetch: 20.81.36.185.in-addr.arpa/PTR 24-Dec-2018 15:34:22.655 resolver: debug 1: fetch: bitbucket.org/A 24-Dec-2018 15:34:22.664 dnssec: info: validating bitbucket.org/A: bad cache hit (bitbucket.org.dlv.isc.org/DLV) 24-Dec-2018 15:34:22.664 lame-servers: info: broken trust chain resolving 'bitbucket.org/A/IN': 5.6.7.8#53 24-Dec-2018 15:34:22.664 query-errors: debug 1: client 127.0.0.1#49536 (bitbucket.org): query failed (SERVFAIL) for bitbucket.org/IN/A at ../../../bin/named/query.c:7773 24-Dec-2018 15:34:26.860 resolver: debug 1: fetch: 2.debian.pool.ntp.org/AAAA 24-Dec-2018 15:34:26.860 resolver: debug 1: fetch: 2.debian.pool.ntp.org/A 

Why is that happening and how can I fix that? And why restarting BIND helps?

OS: Debian 9.6 amd64.

BIND:

ii  bind9                                         1:9.10.3.dfsg.P4-12.3+deb9u4                amd64        Internet Domain Name Server ii  bind9-host                                    1:9.10.3.dfsg.P4-12.3+deb9u4                amd64        Version of 'host' bundled with BIND 9.X ii  bind9utils                                    1:9.10.3.dfsg.P4-12.3+deb9u4                amd64        Utilities for BIND ii  libbind9-140:amd64                            1:9.10.3.dfsg.P4-12.3+deb9u4                amd64        BIND9 Shared Library used by BIND