There's like 13 useful error codes related to DNSSEC failures but literally no standard monitoring tool has all the pieces in place to be able to detect this and surface the specific error, plus the gotcha of these details being "occasionally absent, occasionally ambiguous, never cryptographically trustworthy on its own anyway"
0 Boosts
0 Likes
Would you like to know if the failure your monitoring stack caught was due to an unsupported algorithm? signature expired? signature not yet valid? DNSKEY missing? RRSIGs missing?
"too bad, go fuck yourself" - current state of things