I’ll have to consider this in my own implementation. That is a reasonable way to detect invalid records. Thanks for the correction. I will add, though, that as

I’ll have to consider this in my own implementation. That is a reasonable way to detect invalid records. Thanks for the correction. I will add, though, that as you walk the tree back to the roots, downgrades in the key strength do happen as you get to the root 1024bit keys, which is unfortunate. Aside from that, if DNSSEC is detected to be blocked, or invalid, there’s currently not great mechanisms of signaling this to end users (in most software) to either opt into the security risk or notify them, beyond just failing the lookup.