networkd DNS issues (cannot resolve pip name)

I have configured my pi0w’s wifi as per my own answer to this other question (and this great answer by Ingo that it’s based on) to utilise both AP and Client modes.

Everything generally works fine, however when trying to install pip packages, the name cannot resolve.

After some initial digging, I also can’t ping google.com, although I can ping 8.8.8.8

I have tried adding dns-nameservers 8.8.8.8 to /etc/network/interfaces and also adding nameserver 8.8.8.8 to /etc/resolv.conf

I’m a bit lost where to dig further.

Any help is really appreciated as I currently can’t get any pip packages. Thanks!

Edit:

For sudo systemctl status systemd-resolved.service I get:

Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question 2.debian.pool.ntp.org IN A: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question org IN DS: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question org IN DNSKEY: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question ntp.org IN DS: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question pool.ntp.org IN DS: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question 3.debian.pool.ntp.org IN AAAA: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question debian.pool.ntp.org IN SOA: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question 3.debian.pool.ntp.org IN DS: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question 3.debian.pool.ntp.org IN SOA: signature-expired
Jul 13 00:34:58 raspberrypi2 systemd-resolved[198]: DNSSEC validation failed for question 3.debian.pool.ntp.org IN A: signature-expired

Edit 2:

For resolvectl status I get the following under wlan0, which looks ok

Link 3 (wlan0)
      Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: allow-downgrade
    DNSSEC supported: yes
  Current DNS Server: 192.168.0.1
         DNS Servers: 192.168.0.1
                      fdd0:462a:9688:0:8272:15ff:fee7:df78

…although under Global section, DNSSEC is not supported:

Global
       LLMNR setting: yes
MulticastDNS setting: yes
  DNSOverTLS setting: no
      DNSSEC setting: allow-downgrade
    DNSSEC supported: no
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

[Resolve]
DNS=8.8.8.8 8.8.4.4
FallbackDNS=1.1.1.1 9.9.9.10 8.8.8.8 2606:4700:4700::1111 2620:fe::10 2001:4860:4860::8888
#Domains=
#LLMNR=yes
#MulticastDNS=yes
DNSSEC=allow-downgrade
#DNSSEC=true
#DNSOverTLS=no
#Cache=yes
#DNSStubListener=udp