Get potentially validating resolvers. Note, however, that only because a resolver queries for DS records (qtype 43) or DNSKEY records (qtype 48) and has the DO-bit set does not mean that it actually validates DNSSEC signatures.
Impala Query:
select src, count(src) as tot from dns.queries where year = 2017 and month = 8 and (qtype = 43 or qtype = 48) and edns_do = true group by src order by tot desc