Ah, so you don't like that DNS resolvers just return a regular SERVFAIL when DNSSEC validation fails, without some kind of indication as to why the failure occu

Ah, so you don't like that DNS resolvers just return a regular SERVFAIL when DNSSEC validation fails, without some kind of indication as to why the failure occurred. I agree. I wish a failure of DNSSEC validation returned a different code or set a bit somehow so that resolvers could then know that the failure was because of DNSSEC validation. The resolver could then take action based on that knowledge. A couple of us (who were not involved in the early discussions of DNSSEC) were discussing re-introducing this idea to see what kind of traction it might get now that we've seen a good bit of DNSSEC deployment and have more operational experience.