m.root-servers.net is now serving DNSSEC, but doesn't seem to support TCP. Which means that dig any . +dnssec +bufsize=1400 truncates and then fails on TCP fallback, which seems a bit doubtful to me. Admittedly this query is not usual, and the other root servers will work.