TLDR: Google Public DNS would, until 23 February, not check that the ZSK (signing key used to sign DNSSEC DNS responses) was in turn signed by the KSK. Google

TLDR: Google Public DNS would, until 23 February, not check that the ZSK (signing key used to sign DNSSEC DNS responses) was in turn signed by the KSK. Google would accept any signed response, by any ZSK. Even worse, they would cache this response, and present it to end users as being non-DNSSEC signed. Upon further testing, only Google was found to have had this problem.