IBM Cloud Internet Services ALIAS records with DNSSEC: certificate validation behavior

The goal is to clarify the documented interaction between IBM Cloud Internet Services DNS resolution and IBM Cloud Certificate Manager SSL/TLS certificate validation when a zone uses DNSSEC and contains ALIAS records that resolve to external domains.

CIS supports authoritative DNS with A, AAAA, CNAME, ALIAS and DNSSEC. Certificate Manager validates hostnames, chains and revocation status for imported or issued certificates. The product documentation does not clearly state whether DNSSEC validation is automatically adjusted or disabled for zones that contain ALIAS records pointing externally, and the described behavior is noted as varying by region. That uncertainty creates inconsistent expectations for certificate validation outcomes for external targets.

Does CIS automatically change DNSSEC validation handling for zones with ALIAS records that point to external domains? Is any adjustment applied consistently across regions? How should validation expectations be set for certificates when ALIAS resolution involves external endpoints?