live console
21:43:01[INFO]resolver: building chain of trust for jonty.my
21:43:02[INFO]DS found at parent; digest matches expected
21:43:03[INFO]RRSIG verified; inception ok; expiration ok
21:43:04[INFO]NSEC/NSEC3 proof validated (authenticated denial)
21:43:05[INFO]caching: respecting TTLs; minimizing revalidation
21:43:06[WARN]clock skew check: within tolerance
21:43:07[INFO]EDNS(0): UDP payload size negotiated
21:43:08[INFO]anycast: route selection stable; nearest POP selected
21:43:09[INFO]authoritative: SOA serial observed; zone apex consistent
21:43:10[INFO]query: A/AAAA happy; SVCB/HTTPS optional
21:43:11[INFO]transport: TCP fallback ready (fragmentation avoided)
21:43:12[WARN]delegation hygiene: check for stale DS on rollover
21:43:13[INFO]do=1: validating answers, rejecting bogus
21:43:14[INFO]observability: logging resolver decisions (privacy-preserving)
21:43:15[INFO]end-to-end: secure / authenticated / cached
21:43:01[INFO]resolver: building chain of trust for jonty.my
21:43:02[INFO]DS found at parent; digest matches expected
21:43:03[INFO]RRSIG verified; inception ok; expiration ok
21:43:04[INFO]NSEC/NSEC3 proof validated (authenticated denial)
21:43:05[INFO]caching: respecting TTLs; minimizing revalidation
21:43:06[WARN]clock skew check: within tolerance
21:43:07[INFO]EDNS(0): UDP payload size negotiated
21:43:08[INFO]anycast: route selection stable; nearest POP selected
21:43:09[INFO]authoritative: SOA serial observed; zone apex consistent
21:43:10[INFO]query: A/AAAA happy; SVCB/HTTPS optional
21:43:11[INFO]transport: TCP fallback ready (fragmentation avoided)
21:43:12[WARN]delegation hygiene: check for stale DS on rollover
21:43:13[INFO]do=1: validating answers, rejecting bogus
21:43:14[INFO]observability: logging resolver decisions (privacy-preserving)
21:43:15[INFO]end-to-end: secure / authenticated / cached
knowledge feed
A small shrine to DNS: DNSSEC, Anycast, and the quiet heroism of getting answers back in a few milliseconds.
[FACT]DNSSEC: authenticity + integrity, not encryption.
[FACT]Anycast: one service IP, many sites, BGP decides.
[FACT]DS at the parent is the “pin” for the child zone.
[FACT]NSEC/NSEC3: authenticated denial of existence.
[FACT]RRSIG expiry means re-signing is ops-critical.
[FACT]Monitoring validation failures beats surprise outages.