search

PowerDNS / pdns

PowerDNS Authoritative, PowerDNS Recursor, dnsdist
https://www.powerdns.com/
GNU General Public License v2.0
3.72k stars 913 forks source link

Expected behaviour of blocking domains with broken dnssec rrsig not present with forward-zone-recurse while working together with dnscrypt #6828

Open Syntheatizer opened 6 years ago

Syntheatizer commented 6 years ago

Short description

Expected behaviour of blocking domains with broken dnssec rrsig not present with forward-zone-recurse while working together with dnscrypt

Environment

Steps to reproduce

  1. Insert these lines in a config

    dnssec=validate dnssec-log-bogus=yes forward-zones-file=/etc/powerdns/forward

  2. Insert these lines in /etc/powerdns/forward

    +.=127.0.0.8

  3. Configure dnscrypt (/etc/dnscrypt-proxy/dnscrypt-proxy.conf) like that:

    ProviderName 2.dnscrypt-cert.ns4.ca.luggs.co ProviderKey BCBF:B7E0:50C1:3DA2:422C:00B0:B1AC:9AD6:48C5:C264:BCB6:170B:883D:718A:C86E:BA09 ResolverAddress 142.4.205.47:443

    LocalAddress 127.0.0.8:53

    Expected behaviour

    $ dig +dnssec +multi www.dnssec-failed.org

    ; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec +multi www.dnssec-failed.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36287 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.dnssec-failed.org. IN A

;; Query time: 722 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Sat Aug 04 15:56:29 UTC 2018 ;; MSG SIZE rcvd: 50

Actual behaviour

  $ dig +dnssec +multi www.dnssec-failed.org      

  ; <<>> DiG 9.10.3-P4-Debian <<>> +dnssec +multi www.dnssec-failed.org
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59685
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 11

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags: do; udp: 4096
  ;; QUESTION SECTION:
  ;www.dnssec-failed.org. IN A

  ;; ANSWER SECTION:
  www.dnssec-failed.org.  7200 IN A 69.252.193.191
  www.dnssec-failed.org.  7200 IN A 68.87.109.242
  www.dnssec-failed.org.  7200 IN RRSIG A 5 3 7200 (
                                       20180809172416 20180802141916 44973 dnssec-failed.org.
                                       hN87Z8vRdjvF7jItkveX5Ln/Nnc3Mar8dpKG095TGSac
                                       uKxddeuWRcvDl2QzcPYxslWOmmTknrkfReWQ3QINoGEb
                                       IXwLfX88srdBXn11HwHlIXPvc3Ys8kZgLJoWlWOuzebA
                                       0qlpDgr3uUz08+ty39UCp1s8Vzq7KX+j9OdWXNk= )

 ;; AUTHORITY SECTION:
 dnssec-failed.org.      55646 IN NS dns102.comcast.net.
 dnssec-failed.org.      55646 IN NS dns104.comcast.net.
 dnssec-failed.org.      55646 IN NS dns103.comcast.net.
 dnssec-failed.org.      55646 IN NS dns101.comcast.net.
 dnssec-failed.org.      55646 IN NS dns105.comcast.net.

 ;; ADDITIONAL SECTION:
 dns101.comcast.net.     37039 IN A 69.252.250.103
 dns101.comcast.net.     37039 IN AAAA 2001:558:fe23:8:69:252:250:103
 dns102.comcast.net.     37039 IN A 68.87.85.132
 dns102.comcast.net.     26605 IN AAAA 2001:558:1004:7:68:87:85:132
 dns103.comcast.net.     24068 IN A 68.87.76.228
 dns103.comcast.net.     47635 IN AAAA 2001:558:1014:c:68:87:76:228
 dns104.comcast.net.     50911 IN A 68.87.68.244
 dns104.comcast.net.     50911 IN AAAA 2001:558:100a:5:68:87:68:244
 dns105.comcast.net.     24068 IN A 68.87.72.244
 dns105.comcast.net.     24068 IN AAAA 2001:558:100e:5:68:87:72:244

 ;; Query time: 218 msec
 ;; SERVER: 192.168.1.1#53(192.168.1.1)
 ;; WHEN: Sun Aug 05 02:14:00 CEST 2018
 ;; MSG SIZE  rcvd: 59

Other information

Log while quering pdns

  pdns_recursor[11957]: 1 [1/1] question for 'www.dnssec-failed.org|A' from 127.0.0.1
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for A
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Looking for CNAME cache hit of 'www.dnssec-failed.org|CNAME'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: No CNAME cache hit of 'www.dnssec-failed.org|CNAME' found
  pdns_recursor[11957]: [1] www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|A', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got TA for '.'
  pdns_recursor[11957]: [1] : setting cut state for . to Secure
  pdns_recursor[11957]: [1] : - Looking for a cut at org
  pdns_recursor[11957]: [1] : no TA found for 'org' among 1
  pdns_recursor[11957]: [1]   org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[11957]: [1]   org: No cache hit for 'org|DS', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got status Secure for name org (from .)
  pdns_recursor[11957]: [1]   org: initial validation status for org is Secure
  pdns_recursor[11957]: [1]   org: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1]   org: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1]   org: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1]   org: Trying IP 127.0.0.8:53, asking 'org|DS'
  pdns_recursor[11957]: [1]   org: Got 4 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=1, in 151ms
  pdns_recursor[11957]: [1]   org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   org: accept answer 'org|RRSIG|DS 8 1 86400 20180903225948 20180804225948 52335 . xUb0jV9AEGpn6JdFvfUXyOOo2x0FhvhyZPl6gnyGrMLrnDG899aJttdLpQo0OQBrPThIczZZZQIEStYVESFg1dB/3HZ8hat9EHbmTjI0JMRSp6RsArIVMYEIsslxddjtCqUyoooRlY0Jtzy51ZBK2iHU9MZ36cdLzm1lte3EcfG0gSO++tH0q2OkBXG8PEvNcQ9YonJYaFrE2U7p4thgQBR0xKT6n2TV2+g/+qkNTn/ne4yHch4usDnPC27C+cpAjSaNkf7/H8cKMeq1LWaj1OoCAreE1WfD9Zzq5Lf+CgwbwZ8iElg24ylbHsiZZQyRRIhkIMd4vmSF6JcqNbb65w==' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]   org: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name org (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record org
  pdns_recursor[11957]: [1] Validating non-additional record for org
  pdns_recursor[11957]: [1] Retrieving DNSKeys for .
  pdns_recursor[11957]: [1]    .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[11957]: [1]    .: No cache hit for '.|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got status Secure for name . (from .)
  pdns_recursor[11957]: [1]    .: initial validation status for . is Secure
  pdns_recursor[11957]: [1]    .: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1]    .: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1]    .: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1]    .: Trying IP 127.0.0.8:53, asking '.|DNSKEY'
  pdns_recursor[11957]: [1]    .: using TCP with 127.0.0.8:53
  pdns_recursor[11957]: [1]    .: Got 6 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=1, in 303ms
  pdns_recursor[11957]: [1]    .: accept answer '.|DNSKEY|256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]    .: accept answer '.|DNSKEY|257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]    .: accept answer '.|DNSKEY|256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]    .: accept answer '.|RRSIG|DNSKEY 8 0 86400 20180903225948 20180804225948 47089 . P2qX7Z9hQ7NbO83jOahhvZF/LSpBL13vcBd1D7UAl5MVX5PJ4F5H+lezidnCMq6hcv3kG0M8zSzLJtwTdk0cXLDZEiO/Zj2MpLBoJK6iX8N30+6t96ZVNlmMs0CcHO/9OJxi7cYAcTmwsYG0ImCi0vhKwMWvSoxSumtCyvHRvc2+MRdgmz3j1z+vk0qOXWcQqpzLcDCuzbX0q+w+6zsZ+UiuogB1F7+ofYxwsEuuqNARk7tDAlEpFlWzvBtRBMGPLogt+Hif0d8ktMpT6zemcgbZjvsiChVYDqc/efCr30k1644QLHsl0GVC2DfQdzW2aLJiKX3oDEt0QXePVKdNjaVbAymdH86tfJD5lZsRs5CYLgCp6yvxA2SrafSTOxaae1R5kyWycUnbvIyzw7dADCtlvhJemH9DKwkssEi+7UhmUNqzlL6CR1TS1l2OK2hLdoxqnl+bJEI19Tak+i1kG1lChPrL5RHa/asGDK134yqCfTAmFMATlWVm3sMINbVPRluYDHmwPxKj7N/+Vr225KEsXYrNvhHeqFuI3MNf5hmjxzcATtgwT1O0m+1xeYMezAI6OAfw1Ium8SI0aWMUaLqfdFqtFXxsqdnkZK/LX67oYQ8Vyi6fNOgnDeHoOyZ/pIKloBocPkzVVZqsjCq57gO9Lu2tVHX81HrXYAnl17M=' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]    .: accept answer '.|RRSIG|DNSKEY 8 0 86400 20180903225948 20180804225948 52335 . e8e0RIgDWR/P2hWSmpf21i+52WkHL+64noDbSF7FRaY3ebI4rvgvqbWGdgbTYifNG3nhcgL2LbCwgnk9H+v7RkoH3zKhftWbE//Fye5hfYF0ox3QB4RXJZuvPdNwhzjNwAEZQSUwWFsDEco97FECGUl7a2+dVgPVgYcYhsoodnr0tTdlE60sWdzkicaDn34l52/p1cgN0YJpbwXixkCejNNdSF2VXEXJOiBfaldpJH+A7cZWLT97cTofOHDhJAbyDAH36XgD4mmxngAudL6igfvCRMa1wJB4yuqrrn6KrMeL3LeqwYW7o/gO63yyzj/GoZzcEr+x3e8H2RgNGeLIyA==' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]    .: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name . (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record .
  pdns_recursor[11957]: [1] Validating DNSKEY for .
  pdns_recursor[11957]: [1] : got TA for '.'
  pdns_recursor[11957]: [1] : trying to validate 3 DNSKEYs with 6 DS
  pdns_recursor[11957]: [1] : we now have 3 DNSKEYs
  pdns_recursor[11957]: [1]    .: determining status after receiving this packet
  pdns_recursor[11957]: [1]    .: answer is in: resolved to '256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=|DNSKEY'
  pdns_recursor[11957]: [1]    .: answer is in: resolved to '257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1|DNSKEY'
  pdns_recursor[11957]: [1]    .: answer is in: resolved to '256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=|DNSKEY'
  pdns_recursor[11957]: [1]    .: status=got results, this level of recursion done
  pdns_recursor[11957]: [1]    .: validation status is Secure
  pdns_recursor[11957]: [1] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[11957]: [1] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[11957]: [1] Secure!
  pdns_recursor[11957]: [1]   org: determining status after receiving this packet
  pdns_recursor[11957]: [1]   org: answer is in: resolved to '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5|DS'
  pdns_recursor[11957]: [1]   org: answer is in: resolved to '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982|DS'
  pdns_recursor[11957]: [1]   org: status=got results, this level of recursion done
  pdns_recursor[11957]: [1]   org: validation status is Secure
  pdns_recursor[11957]: [1] : - Found cut at org
  pdns_recursor[11957]: [1] : New state for org is Secure
  pdns_recursor[11957]: [1] : - Looking for a cut at dnssec-failed.org
  pdns_recursor[11957]: [1] : no TA found for 'dnssec-failed.org' among 1
  pdns_recursor[11957]: [1]   dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[11957]: [1]   dnssec-failed.org: No cache hit for 'dnssec-failed.org|DS', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from org)
  pdns_recursor[11957]: [1]   dnssec-failed.org: initial validation status for dnssec-failed.org is Secure
  pdns_recursor[11957]: [1]   dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1]   dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1]   dnssec-failed.org: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1]   dnssec-failed.org: Trying IP 127.0.0.8:53, asking 'dnssec-failed.org|DS'
  pdns_recursor[11957]: [1]   dnssec-failed.org: Got 4 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=0, in 146ms
  pdns_recursor[11957]: [1]   dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from '.' nameservers? ttl=54041, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from '.' nameservers? ttl=54041, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from '.' nameservers? ttl=54041, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]   dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[11957]: [1]   dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[11957]: [1]   dnssec-failed.org: answer is in: resolved to '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce|DS'
  pdns_recursor[11957]: [1]   dnssec-failed.org: answer is in: resolved to '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc|DS'
  pdns_recursor[11957]: [1]   dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[11957]: [1]   dnssec-failed.org: validation status is Secure
  pdns_recursor[11957]: [1] : - Found cut at dnssec-failed.org
  pdns_recursor[11957]: [1] : New state for dnssec-failed.org is Secure
  pdns_recursor[11957]: [1] : - Looking for a cut at www.dnssec-failed.org
  pdns_recursor[11957]: [1] : no TA found for 'www.dnssec-failed.org' among 1
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|DS', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Trying IP 127.0.0.8:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: Got 5 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=0, in 355ms
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|RRSIG|NSEC 5 3 7200 20180809172416 20180802141916 44973 dnssec-failed.org. I0tHfDfFdEoE13g7Io0T0CDeSX0CQFGlJzXzsFJviHzw8Z12ZNWQJ3tIO9EgOrsBV7r4iHok7L/jhmx+bHybj+XYac4yyIQ2gRj9/5x4vKtMdNzjHgwbo+pDtmyqMe/rWQHzt0J8NKK4VTbBqiXNDXu/u6CM+Qe5kHTU90mWtSM=' from '.' nameservers? ttl=300, place=2 RRSIG - separate
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|NSEC|dnssec-failed.org. A TXT RRSIG NSEC' from '.' nameservers? ttl=300, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|SOA|dns101.comcast.org. dnsadmin.comcast.net. 2010101918 900 180 604800 7200' from '.' nameservers? ttl=300, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|SOA 5 2 86400 20180809172416 20180802141916 44973 dnssec-failed.org. AJU3wyc+sNXYqBQtLMf8Y1uhO1pFjUDilVQUEgWuFAMlZLcEMmhUSKp6YtDRzSqr3Mbxn6FUFjlWZpJAbTqNsGRBwt1TR4nckBJnKgUC3pVTkFgaMgwtfdysaRCUJOFPk1E/9rCEsKR7pFItAjzjc0wQiGX/lXbox0bJ8SKVhNs=' from '.' nameservers? ttl=300, place=2 RRSIG - separate
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[11957]: [1] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record www.dnssec-failed.org
  pdns_recursor[11957]: [1] Validating DS record for www.dnssec-failed.org
  pdns_recursor[11957]: [1] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[11957]: [1]    dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[11957]: [1]    dnssec-failed.org: No cache hit for 'dnssec-failed.org|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1]    dnssec-failed.org: initial validation status for dnssec-failed.org is Secure
  pdns_recursor[11957]: [1]    dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1]    dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1]    dnssec-failed.org: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1]    dnssec-failed.org: Trying IP 127.0.0.8:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[11957]: [1]    dnssec-failed.org: Got 5 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=0, in 153ms
  pdns_recursor[11957]: [1]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=' from '.' nameservers? ttl=3227, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr' from '.' nameservers? ttl=3227, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20180809172416 20180802141916 44973 dnssec-failed.org. raTVByMUlZ/fVaJYdfVQxfVP+hen7TPLpuX/AYBHRXwTWuOXJLXG8kfhJG9StM2n6SKNYb9ByksZQE6BgmYHj1f1bBb4tLQ8agCeMSeG2uYutLfXhYoYC1AfTqxuSm0g08KCYOSLHUlo4AOVyVWCXkri3tgt14WMWj7WxLYsJCw=' from '.' nameservers? ttl=3227, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20181130142416 20180802102416 29521 dnssec-failed.org. jVLGqhO4gxcP+MnVQav5ZUDW6emqcGdVhaNLcoa8+rNJrCIldUgYdVGMHyWNesWojAIEnXGEInJl5yFmkeZRp5jKpOPYmApPSrJsG5KgXBTJFWHmfnCDHi6rLRwGzuHJfqnD7caFo2pCMbbKKiGORWkmgwy/zIcbh1CEEIu7KVkZSDowg+CRDTrZx/uTMzQAsNEWunUA3yCPWEjjIRVXoeBv/115qVByzhk41cfb+ClyZhmawzC47IGSaZMDMtQpS2IccGsKa6oZpgwYwXyAPSkOrWC5sCs1t+LsbMvqdn57Ne9k3culo1i4/yUIWOcm3bhwBe7/BsH4TEXBAfXRlw==' from '.' nameservers? ttl=3227, place=1 RRSIG - separate
  pdns_recursor[11957]: [1]    dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[11957]: [1]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[11957]: [1]    dnssec-failed.org: answer is in: resolved to '257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=|DNSKEY'
  pdns_recursor[11957]: [1]    dnssec-failed.org: answer is in: resolved to '256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr|DNSKEY'
  pdns_recursor[11957]: [1]    dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[11957]: [1]    dnssec-failed.org: validation status is Secure
  pdns_recursor[11957]: [1] Retrieved 2 DNSKeys for dnssec-failed.org, state is Secure
  pdns_recursor[11957]: [1] Going to validate 1 record contents with 1 sigs and 2 keys for www.dnssec-failed.org
  pdns_recursor[11957]: [1] Secure!
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: got negative caching indication for 'www.dnssec-failed.org|DS'
  pdns_recursor[11957]: [1]   www.dnssec-failed.org: status=noerror, other types may exist, but we are done (have negative SOA) 
  pdns_recursor[11957]: [1] www.dnssec-failed.org: removing cut state for www.dnssec-failed.org
  pdns_recursor[11957]: [1] : list of cuts from www.dnssec-failed.org to .
  pdns_recursor[11957]:  - .: Secure
  pdns_recursor[11957]:  - org: Secure
  pdns_recursor[11957]:  - dnssec-failed.org: Secure
  pdns_recursor[11957]: [1] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Resolved '.' NS (empty) to: 127.0.0.8
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Trying IP 127.0.0.8:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: Got 17 answers from (empty) (127.0.0.8), rcode=0 (No Error), aa=0, in 148ms
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|A|69.252.193.191' from '.' nameservers? ttl=5556, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|A|68.87.109.242' from '.' nameservers? ttl=5556, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|RRSIG|A 5 3 7200 20180809172416 20180802141916 44973 dnssec-failed.org. hN87Z8vRdjvF7jItkveX5Ln/Nnc3Mar8dpKG095TGSacuKxddeuWRcvDl2QzcPYxslWOmmTknrkfReWQ3QINoGEbIXwLfX88srdBXn11HwHlIXPvc3Ys8kZgLJoWlWOuzebA0qlpDgr3uUz08+ty39UCp1s8Vzq7KX+j9OdWXNk=' from '.' nameservers? ttl=5556, place=1 RRSIG - separate
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from '.' nameservers? ttl=54002, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from '.' nameservers? ttl=54002, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from '.' nameservers? ttl=54002, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from '.' nameservers? ttl=54002, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from '.' nameservers? ttl=54002, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns101.comcast.net|A|69.252.250.103' from '.' nameservers? ttl=35395, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns101.comcast.net|AAAA|2001:558:fe23:8:69:252:250:103' from '.' nameservers? ttl=64890, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns102.comcast.net|A|68.87.85.132' from '.' nameservers? ttl=35395, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns102.comcast.net|AAAA|2001:558:1004:7:68:87:85:132' from '.' nameservers? ttl=64890, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns103.comcast.net|A|68.87.76.228' from '.' nameservers? ttl=22424, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns103.comcast.net|AAAA|2001:558:1014:c:68:87:76:228' from '.' nameservers? ttl=45991, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns104.comcast.net|A|68.87.68.244' from '.' nameservers? ttl=49267, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: accept answer 'dns105.comcast.net|A|68.87.72.244' from '.' nameservers? ttl=22424, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[11957]: [1] www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[11957]: [1] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[11957]: [1] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record www.dnssec-failed.org
  pdns_recursor[11957]: [1] : got status Secure for name dns101.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns101.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns101.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns101.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns102.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns102.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns102.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns102.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns103.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns103.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns103.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns103.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns104.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns104.comcast.net
  pdns_recursor[11957]: [1] : got status Secure for name dns105.comcast.net (from .)
  pdns_recursor[11957]: [1] : got initial zone status Secure for record dns105.comcast.net
  pdns_recursor[11957]: [1] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[11957]: [1] www.dnssec-failed.org: answer is in: resolved to '69.252.193.191|A'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: answer is in: resolved to '68.87.109.242|A'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[11957]: [1] www.dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[11957]: [1] www.dnssec-failed.org: validation status is Secure
  pdns_recursor[11957]: Starting validation of answer to www.dnssec-failed.org|A for 127.0.0.1:57046
  pdns_recursor[11957]: Answer to www.dnssec-failed.org|A for 127.0.0.1:57046 validates correctly
rgacogne commented 6 years ago

Our current behavior is to disable DNSSEC validation when a forward rule is applied, because in most cases it's simply not going to work. Getting answers already processed by a recursor means we sometimes don't get all the necessary information to properly detect the DNSSEC state of a given zone cut.

Syntheatizer commented 6 years ago

I will do that, thanks. But anyway it would be nice also to check in a good way the RRSIG, because as I know you cannot validate a RRSIG whose DS key cannot be obtained Anyway I've set the forward-zone-file for testing for forwarding directly to the DNS server as follows

  +.=142.4.205.47

and in that situaton seems to work

  pdns_recursor[21596]: [21] www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for A
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Looking for CNAME cache hit of 'www.dnssec-failed.org|CNAME'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: No CNAME cache hit of 'www.dnssec-failed.org|CNAME' found
  pdns_recursor[21596]: [21] www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|A', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got TA for '.'
  pdns_recursor[21596]: [21] : setting cut state for . to Secure
  pdns_recursor[21596]: [21] : - Looking for a cut at org
  pdns_recursor[21596]: [21] : no TA found for 'org' among 1
  pdns_recursor[21596]: [21]   org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [21]   org: No cache hit for 'org|DS', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name org (from .)
  pdns_recursor[21596]: [21]   org: initial validation status for org is Secure
  pdns_recursor[21596]: [21]   org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]   org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]   org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]   org: Trying IP 142.4.205.47:53, asking 'org|DS'
  pdns_recursor[21596]: [21]   org: Got 4 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=1, in 148ms
  pdns_recursor[21596]: [21]   org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]   org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating non-additional record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]    .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    .: No cache hit for '.|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name . (from .)
  pdns_recursor[21596]: [21]    .: initial validation status for . is Secure
  pdns_recursor[21596]: [21]    .: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]    .: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]    .: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]    .: Trying IP 142.4.205.47:53, asking '.|DNSKEY'
  pdns_recursor[21596]: [21]    .: using TCP with 142.4.205.47:53
  pdns_recursor[21596]: [21]    .: Got 6 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=1, in 329ms
  pdns_recursor[21596]: [21]    .: accept answer '.|DNSKEY|256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    .: accept answer '.|DNSKEY|256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    .: accept answer '.|DNSKEY|257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1' from '.' nameservers? ttl=86400, place=1 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    .: accept answer '.|RRSIG|DNSKEY 8 0 86400 20180904100448 20180805100448 47089 . EkmLfcD5Fa/+RGtYD9vFVbhedsgDIPDBB8JSgFgzSLp4cTq0ooEsGO98ZSHpKjJj0Z82z6Qbrvc0hrmsjtKamBvbpTaogErGkAwzZ1acb9rc9mJolsSuz0Cm6wPrGs4apwek2K11CdFfcIILoW0jizxMXb9+lY1YBfwwskoV/rZsaBaAI+WMVP2UT8mAPmUzSAN5EhPoZPUu5yv4YC3sF3SOYOVyJmB0p+4A/babRMf0UhvNC37RSUcotESVBO5CmwUvJZggyzHQHqPtdaRkCuc8GRG5gk05jFGeRVgpxnZ4uvA+/XJ0d+lWP85bs4E+E0KD/UhqNZRSPShZPmZ7hUFn3cyPv8kcVI9jpeAKrrM3T+ASJWWO46SUWSz6m7BbjMnTP0HCR3f3zV9y8hTrlrpLxJUMoc74cTLhVl2mGrn2iQvK0Q3NuiG2FgQiw8amNPkYwQtv4aHrgMsKfjaRApdrgJKfVwdaPMvwnGSCYeKgBjdQ/xWGv3ylia+GVQfTr0wPJ9b1iR2HCVAHD1eanAwFzeC6U4PpgjLPCtZ0bBiD5uYawHG51+sSDx7c/g4xlgMOVYHsFV1RDwabg888ywYJ01gHCazAeAsCAJUtBJ8e49gP2Rf2pu17mHAJIblbHgnGNAIkEdFsu7dpm9/A4yeFw79QVmRiaAlk4RtS0Q8=' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    .: accept answer '.|RRSIG|DNSKEY 8 0 86400 20180904100448 20180805100448 52335 . tFKTzQkNG6hfwq1zQNm9WR/G0pCj2L61wHjXlXbUqtjcybyULZk3esNQ/C4/DgwZz6NQ/1hUmQJ/bUNtJclXCAkyExhqa1Mg1z44jOnz8jjhDPJU3DZvSOrBWpzKFErPtcXcV8d/0t/25KDifrAMyF3z/BgM+hHx0oBFUE/v6og+1WJpG5Ts/4GwSwUdZGUwDnXBGU9o/SS7jIvEqefeuQYr1eOlwjNtNf+oWCQK938Gh2Z6xn49FTfcDlnMB8xRRTcmGU6o+hurTw4BkqkmFO//wIUcjmBNfXOX/9PTy24TZtrMbWwS23/+egZgWY2RU3BeogHkq0yqd1qUI/MXDA==' from '.' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    .: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name . (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record .
  pdns_recursor[21596]: [21] Validating DNSKEY for .
  pdns_recursor[21596]: [21] : got TA for '.'
  pdns_recursor[21596]: [21] : trying to validate 3 DNSKEYs with 6 DS
  pdns_recursor[21596]: [21] : we now have 3 DNSKEYs
  pdns_recursor[21596]: [21]    .: determining status after receiving this packet
  pdns_recursor[21596]: [21]    .: answer is in: resolved to '256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=|DNSKEY'
  pdns_recursor[21596]: [21]    .: answer is in: resolved to '256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=|DNSKEY'
  pdns_recursor[21596]: [21]    .: answer is in: resolved to '257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1|DNSKEY'
  pdns_recursor[21596]: [21]    .: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]    .: validation status is Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21]   org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   org: answer is in: resolved to '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5|DS'
  pdns_recursor[21596]: [21]   org: answer is in: resolved to '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982|DS'
  pdns_recursor[21596]: [21]   org: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]   org: validation status is Secure
  pdns_recursor[21596]: [21] : - Found cut at org
  pdns_recursor[21596]: [21] : New state for org is Secure
  pdns_recursor[21596]: [21] : - Looking for a cut at dnssec-failed.org
  pdns_recursor[21596]: [21] : no TA found for 'dnssec-failed.org' among 1
  pdns_recursor[21596]: [21]   dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [21]   dnssec-failed.org: No cache hit for 'dnssec-failed.org|DS', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from org)
  pdns_recursor[21596]: [21]   dnssec-failed.org: initial validation status for dnssec-failed.org is Secure
  pdns_recursor[21596]: [21]   dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]   dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]   dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]   dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 158ms
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DS record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]    .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=60] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=60] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=60] 
  pdns_recursor[21596]: [21]    .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21]   dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [21]   dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [21]   dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [21]   dnssec-failed.org.: Nameservers: c0.org.afilias-nst.info.(0.00ms), b0.org.afilias-nst.org.(0.00ms), a2.org.afilias-nst.info.(0.00ms), 
  pdns_recursor[21596]: [21]   dnssec-failed.org.:              b2.org.afilias-nst.org.(0.00ms), a0.org.afilias-nst.info.(0.00ms), d0.org.afilias-nst.org.(0.00ms)
  pdns_recursor[21596]: [21]   dnssec-failed.org: Trying to resolve NS 'c0.org.afilias-nst.info' (1/6)
  pdns_recursor[21596]: [21]      c0.org.afilias-nst.info: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]      c0.org.afilias-nst.info: Found cache hit for A: 199.19.53.1[ttl=169995] 
  pdns_recursor[21596]: [21]      c0.org.afilias-nst.info: updating validation state with cache content for c0.org.afilias-nst.info to Insecure
  pdns_recursor[21596]: [21]     Nameserver c0.org.afilias-nst.info IPs: 2001:500:b::1(0.00ms), 199.19.53.1(0.00ms)
  pdns_recursor[21596]: [21]   dnssec-failed.org: Resolved 'org' NS c0.org.afilias-nst.info to: 2001:500:b::1, 199.19.53.1
  pdns_recursor[21596]: [21]   dnssec-failed.org: Trying IP [2001:500:b::1]:53, asking 'dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   dnssec-failed.org: Got 4 answers from c0.org.afilias-nst.info (2001:500:b::1), rcode=0 (No Error), aa=1, in 906ms
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=1 YES!
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=1 YES!
  pdns_recursor[21596]: [21]   dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]   dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating non-additional record for dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for org
  pdns_recursor[21596]: [21]    org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    org: No cache hit for 'org|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21]    org: initial validation status for org is Secure
  pdns_recursor[21596]: [21]    org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]    org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]    org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]    org: Trying IP 142.4.205.47:53, asking 'org|DNSKEY'
  pdns_recursor[21596]: [21]    org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 149ms
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]    org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DS record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]     .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]     .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=59] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=59] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=59] 
  pdns_recursor[21596]: [21]     .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21]    org: determining status after receiving this packet
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [21]    org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [21]    org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [21]    org.: Nameservers: a2.org.afilias-nst.info.(0.00ms), b2.org.afilias-nst.org.(0.00ms), b0.org.afilias-nst.org.(0.00ms), 
  pdns_recursor[21596]: [21]    org.:              c0.org.afilias-nst.info.(0.00ms), a0.org.afilias-nst.info.(0.00ms), d0.org.afilias-nst.org.(0.00ms)
  pdns_recursor[21596]: [21]    org: Trying to resolve NS 'a2.org.afilias-nst.info' (1/6)
  pdns_recursor[21596]: [21]       a2.org.afilias-nst.info: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]       a2.org.afilias-nst.info: Found cache hit for A: 199.249.112.1[ttl=169994] 
  pdns_recursor[21596]: [21]       a2.org.afilias-nst.info: updating validation state with cache content for a2.org.afilias-nst.info to Insecure
  pdns_recursor[21596]: [21]      Nameserver a2.org.afilias-nst.info IPs: 2001:500:40::1(0.00ms), 199.249.112.1(0.00ms)
  pdns_recursor[21596]: [21]    org: Resolved 'org' NS a2.org.afilias-nst.info to: 2001:500:40::1, 199.249.112.1
  pdns_recursor[21596]: [21]    org: Trying IP [2001:500:40::1]:53, asking 'org|DNSKEY'
  pdns_recursor[21596]: [21]    org: timeout resolving after 1502.06msec 
  pdns_recursor[21596]: [21]    org: Trying IP 199.249.112.1:53, asking 'org|DNSKEY'
  pdns_recursor[21596]: [21]    org: Got 8 answers from a2.org.afilias-nst.info (199.249.112.1), rcode=0 (No Error), aa=1, in 87ms
  pdns_recursor[21596]: [21]    org: accept answer 'org|DNSKEY|256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7' from 'org' nameservers? ttl=900, place=1 YES!
  pdns_recursor[21596]: [21]    org: accept answer 'org|DNSKEY|256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/' from 'org' nameservers? ttl=900, place=1 YES!
  pdns_recursor[21596]: [21]    org: accept answer 'org|DNSKEY|257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=' from 'org' nameservers? ttl=900, place=1 YES!
  pdns_recursor[21596]: [21]    org: accept answer 'org|DNSKEY|257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=' from 'org' nameservers? ttl=900, place=1 YES!
  pdns_recursor[21596]: [21]    org: accept answer 'org|RRSIG|DNSKEY 7 1 900 20180822153117 20180801143117 1862 org. MITDQLaNDr6zzue1fAEipDkJPHs9aLCA+K+Bewo/Wq81Ir0kW/NoAxVgawIo9n/c5oJ+kK2B1l7WapjY5UxwP/F7Io4nBJwd3mBhd8p0sciMt5YKruEvdPOsGkimgcn222MQ9Kbh5m6YmldKOAOVGYbXbCghL5yK+2D1mKJ0eiM=' from 'org' nameservers? ttl=900, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    org: accept answer 'org|RRSIG|DNSKEY 7 1 900 20180822153117 20180801143117 9795 org. aPoEqxO5llSarqSVquZayyE+jMdMBci8qD4DzEZf/rjE1BlihX4zbABCHq/1gWwKT8HkQhMvrmqaqEhAoBBJ0LvHXO5SeGtEDbYzfLT7hsWE0UkwG4aHcHevkXpI7eFgkO3oH7ddcDXiCYxJSOXkHsqzpi9A0S4Bd4VIBMDrLYagdBYPOZD+b9Pf52v+MV+iqF5v3mO0TOXSGKxwbV0snV36LAhfzNiwn287QClI605/MQo7SN4+CfCcGeA/erK2RXgYmXTgxum5HeYFm9hynBvNMWPdgqOj8kRKrHuNO3IPOkfWyWZcAMCnSD30Q5iG/B9Mz82Vs58NAHvGNidXaQ==' from 'org' nameservers? ttl=900, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    org: accept answer 'org|RRSIG|DNSKEY 7 1 900 20180822153117 20180801143117 17883 org. MwamqCxgHwE7FJYO+1EeHUTMuRLTH1LrL9gKlNXapCoptTSBJ6jwmt1qN//G/oO5phfwhw8kL38A/bxwKqp3b1kVkZ7fUrFYTS0qJte1Ub5G1PcW532b7xMM25DFeItpGQD8phQ13/fmedChYoFy709zyrr7Rb1wwaZGqZFkzpv3DERJN+svfwBt5krnHF0yI29Bjmd/3NwNc12RremnXt+DUj8/D+Jf57o9Se5owbwBft+nijTKdKNILJzQIlyb49Tru0QOuZBXb0iawban+EDYu4QUYULTKaQCDgBetoCXofDm8Q96fds060LgZBn49v5sb2AMIPnxIy05mOAvQg==' from 'org' nameservers? ttl=900, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DNSKEY for org
  pdns_recursor[21596]: [21] : no TA found for 'org' among 1
  pdns_recursor[21596]: [21]     org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [21]     org: Found cache hit for DS: 9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5[ttl=58] 9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982[ttl=58] 
  pdns_recursor[21596]: [21]     org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [21] : trying to validate 4 DNSKEYs with 1 DS
  pdns_recursor[21596]: [21] : we now have 4 DNSKEYs
  pdns_recursor[21596]: [21]    org: determining status after receiving this packet
  pdns_recursor[21596]: [21]    org: answer is in: resolved to '256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7|DNSKEY'
  pdns_recursor[21596]: [21]    org: answer is in: resolved to '256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/|DNSKEY'
  pdns_recursor[21596]: [21]    org: answer is in: resolved to '257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=|DNSKEY'
  pdns_recursor[21596]: [21]    org: answer is in: resolved to '257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=|DNSKEY'
  pdns_recursor[21596]: [21]    org: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]    org: validation status is Secure
  pdns_recursor[21596]: [21] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21]   dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   dnssec-failed.org: answer is in: resolved to '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce|DS'
  pdns_recursor[21596]: [21]   dnssec-failed.org: answer is in: resolved to '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc|DS'
  pdns_recursor[21596]: [21]   dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]   dnssec-failed.org: validation status is Secure
  pdns_recursor[21596]: [21] : - Found cut at dnssec-failed.org
  pdns_recursor[21596]: [21] : New state for dnssec-failed.org is Secure
  pdns_recursor[21596]: [21] : - Looking for a cut at www.dnssec-failed.org
  pdns_recursor[21596]: [21] : no TA found for 'www.dnssec-failed.org' among 1
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|DS', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 164ms
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DS record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]    .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=57] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=57] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=57] 
  pdns_recursor[21596]: [21]    .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [21]   www.dnssec-failed.org.: Nameservers: b0.org.afilias-nst.org.(0.00ms), b2.org.afilias-nst.org.(0.00ms), c0.org.afilias-nst.info.(0.00ms), 
  pdns_recursor[21596]: [21]   www.dnssec-failed.org.:              a0.org.afilias-nst.info.(0.00ms), d0.org.afilias-nst.org.(0.00ms), a2.org.afilias-nst.info.(87.04ms)
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Trying to resolve NS 'b0.org.afilias-nst.org' (1/6)
  pdns_recursor[21596]: [21]      b0.org.afilias-nst.org: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]      b0.org.afilias-nst.org: Found cache hit for A: 199.19.54.1[ttl=169992] 
  pdns_recursor[21596]: [21]      b0.org.afilias-nst.org: updating validation state with cache content for b0.org.afilias-nst.org to Insecure
  pdns_recursor[21596]: [21]     Nameserver b0.org.afilias-nst.org IPs: 199.19.54.1(0.00ms), 2001:500:c::1(0.00ms)
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Resolved 'org' NS b0.org.afilias-nst.org to: 199.19.54.1, 2001:500:c::1
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Trying IP 199.19.54.1:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Got 9 answers from b0.org.afilias-nst.org (199.19.54.1), rcode=0 (No Error), aa=0, in 68ms
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for org
  pdns_recursor[21596]: [21]    org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=60] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=60] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=60] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=60] 
  pdns_recursor[21596]: [21]    org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [21] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [21]   www.dnssec-failed.org.: Nameservers: dns102.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), dns104.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [21]   www.dnssec-failed.org.:              dns105.comcast.net.(0.00ms), dns103.comcast.net.(0.00ms)
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Trying to resolve NS 'dns102.comcast.net' (1/5)
  pdns_recursor[21596]: [21]      dns102.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]      dns102.comcast.net: No cache hit for 'dns102.comcast.net|A', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got TA for '.'
  pdns_recursor[21596]: [21] : setting cut state for . to Secure
  pdns_recursor[21596]: [21]      dns102.comcast.net: initial validation status for dns102.comcast.net is Indeterminate
  pdns_recursor[21596]: [21]      dns102.comcast.net: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]      dns102.comcast.net: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]      dns102.comcast.net: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]      dns102.comcast.net: Trying IP 142.4.205.47:53, asking 'dns102.comcast.net|A'
  pdns_recursor[21596]: [21]      dns102.comcast.net: Got 42 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 149ms
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|h.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|l.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|k.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|j.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|b.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|g.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|e.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|a.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|m.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|c.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|f.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|d.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|NS|i.gtld-servers.net.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|DS|35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'net|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . DVc7XlVnLqtXY7JB5vnwKVP1wYpwIB+wLSWR2EuQ5MAHrPx4qZEgiZ5pN/FiTcCqT2W/LO9pPbMTypH16GCoFFDX9NsJ75289e2phE3r8N7frrro1QTqS97VaZ/kbffimy84RKg0Ca0rr/llABBZIPTPgDNifk9NAsahfrlMNw8xApSZ85CTvLD1xxP1++63nSEgeb91rHRqS3dIIpYMRfEdFqyX3SyPUwAPgP8/v6tazYBhhrkSLSEiHnDM1CHDJpncwajyxQKqDwFHFvjHBsp78I3F7biCwOxOF+PcqoqNk24aHJd0Wnflk7eEG6o13eY+xZeoSQ68oaK3MASP1w==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'a.gtld-servers.net|A|192.5.6.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'a.gtld-servers.net|AAAA|2001:503:a83e::2:30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'b.gtld-servers.net|A|192.33.14.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'b.gtld-servers.net|AAAA|2001:503:231d::2:30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'c.gtld-servers.net|A|192.26.92.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'c.gtld-servers.net|AAAA|2001:503:83eb::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'd.gtld-servers.net|A|192.31.80.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'd.gtld-servers.net|AAAA|2001:500:856e::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'e.gtld-servers.net|A|192.12.94.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'e.gtld-servers.net|AAAA|2001:502:1ca1::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'f.gtld-servers.net|A|192.35.51.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'f.gtld-servers.net|AAAA|2001:503:d414::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'g.gtld-servers.net|A|192.42.93.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'g.gtld-servers.net|AAAA|2001:503:eea3::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'h.gtld-servers.net|A|192.54.112.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'h.gtld-servers.net|AAAA|2001:502:8cc::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'i.gtld-servers.net|A|192.43.172.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'i.gtld-servers.net|AAAA|2001:503:39c1::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'j.gtld-servers.net|A|192.48.79.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'j.gtld-servers.net|AAAA|2001:502:7094::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'k.gtld-servers.net|A|192.52.178.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'k.gtld-servers.net|AAAA|2001:503:d2d::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'l.gtld-servers.net|A|192.41.162.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'l.gtld-servers.net|AAAA|2001:500:d937::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'm.gtld-servers.net|A|192.55.83.30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'm.gtld-servers.net|AAAA|2001:501:b1f9::30' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]      dns102.comcast.net: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record a.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record a.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record b.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record b.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record c.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record c.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record d.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record d.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record e.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record e.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record f.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record f.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record g.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record g.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record h.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record h.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record i.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record i.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record j.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record j.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record k.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record k.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record l.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record l.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record m.gtld-servers.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record m.gtld-servers.net
  pdns_recursor[21596]: [21]      dns102.comcast.net: determining status after receiving this packet
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'h.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'l.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'k.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'j.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'b.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'g.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'e.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'a.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'm.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'c.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'f.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'd.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'net' -> 'i.gtld-servers.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got DS record 'net' -> '35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee'
  pdns_recursor[21596]: [21]      dns102.comcast.net: status=did not resolve, got 13 NS, looping to them
  pdns_recursor[21596]: [21]      dns102.comcast.net.: Nameservers: g.gtld-servers.net.(0.00ms), d.gtld-servers.net.(0.00ms), c.gtld-servers.net.(0.00ms), 
  pdns_recursor[21596]: [21]      dns102.comcast.net.:              f.gtld-servers.net.(0.00ms), h.gtld-servers.net.(0.00ms), i.gtld-servers.net.(0.00ms), 
  pdns_recursor[21596]: [21]      dns102.comcast.net.:              a.gtld-servers.net.(0.00ms), k.gtld-servers.net.(0.00ms), m.gtld-servers.net.(0.00ms), 
  pdns_recursor[21596]: [21]      dns102.comcast.net.:              e.gtld-servers.net.(0.00ms), l.gtld-servers.net.(0.00ms), j.gtld-servers.net.(0.00ms), 
  pdns_recursor[21596]: [21]      dns102.comcast.net.:              b.gtld-servers.net.(0.00ms)
  pdns_recursor[21596]: [21]      dns102.comcast.net: Trying to resolve NS 'g.gtld-servers.net' (1/13)
  pdns_recursor[21596]: [21]         g.gtld-servers.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]         g.gtld-servers.net: Found cache hit for A: 192.42.93.30[ttl=169992] 
  pdns_recursor[21596]: [21]         g.gtld-servers.net: updating validation state with cache content for g.gtld-servers.net to Insecure
  pdns_recursor[21596]: [21]        Nameserver g.gtld-servers.net IPs: 2001:503:eea3::30(0.00ms), 192.42.93.30(0.00ms)
  pdns_recursor[21596]: [21]      dns102.comcast.net: Resolved 'net' NS g.gtld-servers.net to: 2001:503:eea3::30, 192.42.93.30
  pdns_recursor[21596]: [21]      dns102.comcast.net: Trying IP [2001:503:eea3::30]:53, asking 'dns102.comcast.net|A'
  pdns_recursor[21596]: [21]      dns102.comcast.net: Got 19 answers from g.gtld-servers.net (2001:503:eea3::30), rcode=0 (No Error), aa=0, in 278ms
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|NS|dns101.comcast.net.' from 'net' nameservers? ttl=172800, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|NS|dns102.comcast.net.' from 'net' nameservers? ttl=172800, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|NS|dns103.comcast.net.' from 'net' nameservers? ttl=172800, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|NS|dns104.comcast.net.' from 'net' nameservers? ttl=172800, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|NS|dns105.comcast.net.' from 'net' nameservers? ttl=172800, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|DS|40909 5 2 30c0f50e68dcc9a2f279a994c07cf22ced97aadf44c2b1fe38a1b32ba1a34174' from 'net' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|DS|40909 5 1 ddc19733884ee533b35b4b57717bea9b0ef2c4d1' from 'net' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'comcast.net|RRSIG|DS 8 2 86400 20180812052103 20180805041103 7934 net. T3JRgNLdZObpg+zXXheaab8m6C73bhR4VlptOGf8GE/mj0bg/tP3g7EdnJBjrpyOudJb+Vxpm0qti3ipEF/gV5Aybg2NGxq4aCyHG1ven6kSMUxe0MFmXUIQsL3IzAQ1HGTxP04R4mtSyBRFDB+GP7C7NgssxaDgWtJHJvKeF4o=' from 'net' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns101.comcast.net|AAAA|2001:558:fe23:8:69:252:250:103' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns101.comcast.net|A|69.252.250.103' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns102.comcast.net|AAAA|2001:558:1004:7:68:87:85:132' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns102.comcast.net|A|68.87.85.132' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns103.comcast.net|AAAA|2001:558:1014:c:68:87:76:228' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns103.comcast.net|A|68.87.76.228' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns104.comcast.net|AAAA|2001:558:100a:5:68:87:68:244' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns104.comcast.net|A|68.87.68.244' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns105.comcast.net|AAAA|2001:558:100e:5:68:87:72:244' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns105.comcast.net|A|68.87.72.244' from 'net' nameservers? ttl=172800, place=3 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: OPT answer '.' from 'net' nameservers
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns101.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns101.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns102.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns102.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns103.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns103.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns104.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns104.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns105.comcast.net
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns105.comcast.net
  pdns_recursor[21596]: [21]      dns102.comcast.net: determining status after receiving this packet
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'comcast.net' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'comcast.net' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'comcast.net' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'comcast.net' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got NS record 'comcast.net' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got DS record 'comcast.net' -> '40909 5 2 30c0f50e68dcc9a2f279a994c07cf22ced97aadf44c2b1fe38a1b32ba1a34174'
  pdns_recursor[21596]: [21]      dns102.comcast.net: got DS record 'comcast.net' -> '40909 5 1 ddc19733884ee533b35b4b57717bea9b0ef2c4d1'
  pdns_recursor[21596]: [21]      dns102.comcast.net: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [21]      dns102.comcast.net.: Nameservers: dns104.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), dns102.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [21]      dns102.comcast.net.:              dns105.comcast.net.(0.00ms), dns103.comcast.net.(0.00ms)
  pdns_recursor[21596]: [21]      dns102.comcast.net: Trying to resolve NS 'dns104.comcast.net' (1/5)
  pdns_recursor[21596]: [21]         dns104.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]         dns104.comcast.net: Found cache hit for A: 68.87.68.244[ttl=60] 
  pdns_recursor[21596]: [21]         dns104.comcast.net: updating validation state with cache content for dns104.comcast.net to Indeterminate
  pdns_recursor[21596]: [21]        Nameserver dns104.comcast.net IPs: 68.87.68.244(0.00ms), 2001:558:100a:5:68:87:68:244(0.00ms)
  pdns_recursor[21596]: [21]      dns102.comcast.net: Resolved 'comcast.net' NS dns104.comcast.net to: 68.87.68.244, 2001:558:100a:5:68:87:68:244
  pdns_recursor[21596]: [21]      dns102.comcast.net: Trying IP 68.87.68.244:53, asking 'dns102.comcast.net|A'
  pdns_recursor[21596]: [21]      dns102.comcast.net: Got 3 answers from dns104.comcast.net (68.87.68.244), rcode=0 (No Error), aa=1, in 159ms
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns102.comcast.net|A|68.87.85.132' from 'comcast.net' nameservers? ttl=7200, place=1 YES!
  pdns_recursor[21596]: [21]      dns102.comcast.net: accept answer 'dns102.comcast.net|RRSIG|A 5 3 7200 20180809172144 20180802141644 26550 comcast.net. q//rWCVojZ/FqYmG5rOsipkX5BK+2Ev23BOu/jvQvXJ9nEnOOf8d436etZJsELK0SFwxFeKzckLhh/Ee8TneuAPHXKHFfyVzLmaYi46wK8fA5nKRxWT5UEzkOynljUDgQy38FIgxH8L+3QSEDkmHkthjHu6s6rIhAG0gSBodQME=' from 'comcast.net' nameservers? ttl=7200, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]      dns102.comcast.net: OPT answer '.' from 'comcast.net' nameservers
  pdns_recursor[21596]: [21] : got initial zone status Indeterminate for record dns102.comcast.net
  pdns_recursor[21596]: [21]      dns102.comcast.net: determining status after receiving this packet
  pdns_recursor[21596]: [21]      dns102.comcast.net: answer is in: resolved to '68.87.85.132|A'
  pdns_recursor[21596]: [21]      dns102.comcast.net: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]      dns102.comcast.net: validation status is Indeterminate
  pdns_recursor[21596]: [21]     Nameserver dns102.comcast.net IPs: 68.87.85.132(0.00ms), 2001:558:1004:7:68:87:85:132(0.00ms)
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns102.comcast.net to: 68.87.85.132, 2001:558:1004:7:68:87:85:132
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Trying IP 68.87.85.132:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: Got 5 answers from dns102.comcast.net (68.87.85.132), rcode=0 (No Error), aa=1, in 194ms
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|SOA|dns101.comcast.org. dnsadmin.comcast.net. 2010101918 900 180 604800 7200' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|SOA 5 2 86400 20180809172416 20180802141916 44973 dnssec-failed.org. AJU3wyc+sNXYqBQtLMf8Y1uhO1pFjUDilVQUEgWuFAMlZLcEMmhUSKp6YtDRzSqr3Mbxn6FUFjlWZpJAbTqNsGRBwt1TR4nckBJnKgUC3pVTkFgaMgwtfdysaRCUJOFPk1E/9rCEsKR7pFItAjzjc0wQiGX/lXbox0bJ8SKVhNs=' from 'dnssec-failed.org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|NSEC|dnssec-failed.org. A TXT RRSIG NSEC' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 YES!
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|RRSIG|NSEC 5 3 7200 20180809172416 20180802141916 44973 dnssec-failed.org. I0tHfDfFdEoE13g7Io0T0CDeSX0CQFGlJzXzsFJviHzw8Z12ZNWQJ3tIO9EgOrsBV7r4iHok7L/jhmx+bHybj+XYac4yyIQ2gRj9/5x4vKtMdNzjHgwbo+pDtmyqMe/rWQHzt0J8NKK4VTbBqiXNDXu/u6CM+Qe5kHTU90mWtSM=' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: OPT answer '.' from 'dnssec-failed.org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating non-additional record for dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[21596]: [21]    dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    dnssec-failed.org: No cache hit for 'dnssec-failed.org|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21]    dnssec-failed.org: initial validation status for dnssec-failed.org is Secure
  pdns_recursor[21596]: [21]    dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21]    dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21]    dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 159ms
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21]    dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DS record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]     .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]     .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=56] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=56] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=56] 
  pdns_recursor[21596]: [21]     .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [21]    dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [21]    dnssec-failed.org.: Nameservers: b2.org.afilias-nst.org.(0.00ms), c0.org.afilias-nst.info.(0.00ms), a0.org.afilias-nst.info.(0.00ms), 
  pdns_recursor[21596]: [21]    dnssec-failed.org.:              d0.org.afilias-nst.org.(0.00ms), b0.org.afilias-nst.org.(0.00ms), a2.org.afilias-nst.info.(85.56ms)
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying to resolve NS 'b2.org.afilias-nst.org' (1/6)
  pdns_recursor[21596]: [21]       b2.org.afilias-nst.org: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]       b2.org.afilias-nst.org: Found cache hit for A: 199.249.120.1[ttl=169991] 
  pdns_recursor[21596]: [21]       b2.org.afilias-nst.org: updating validation state with cache content for b2.org.afilias-nst.org to Insecure
  pdns_recursor[21596]: [21]      Nameserver b2.org.afilias-nst.org IPs: 2001:500:48::1(0.00ms), 199.249.120.1(0.00ms)
  pdns_recursor[21596]: [21]    dnssec-failed.org: Resolved 'org' NS b2.org.afilias-nst.org to: 2001:500:48::1, 199.249.120.1
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying IP [2001:500:48::1]:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: timeout resolving after 1953.18msec 
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying IP 199.249.120.1:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: Got 9 answers from b2.org.afilias-nst.org (199.249.120.1), rcode=0 (No Error), aa=0, in 68ms
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21]    dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for org
  pdns_recursor[21596]: [21]     org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]     org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=57] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=57] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=57] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=57] 
  pdns_recursor[21596]: [21]     org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [21] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [21]    dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [21]    dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [21]    dnssec-failed.org.: Nameservers: dns101.comcast.net.(0.00ms), dns102.comcast.net.(0.00ms), dns105.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [21]    dnssec-failed.org.:              dns103.comcast.net.(0.00ms), dns104.comcast.net.(0.00ms)
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying to resolve NS 'dns101.comcast.net' (1/5)
  pdns_recursor[21596]: [21]       dns101.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]       dns101.comcast.net: Found cache hit for A: 69.252.250.103[ttl=57] 
  pdns_recursor[21596]: [21]       dns101.comcast.net: updating validation state with cache content for dns101.comcast.net to Indeterminate
  pdns_recursor[21596]: [21]      Nameserver dns101.comcast.net IPs: 69.252.250.103(0.00ms), 2001:558:fe23:8:69:252:250:103(0.00ms)
  pdns_recursor[21596]: [21]    dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns101.comcast.net to: 69.252.250.103, 2001:558:fe23:8:69:252:250:103
  pdns_recursor[21596]: [21]    dnssec-failed.org: Trying IP 69.252.250.103:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: Got 5 answers from dns101.comcast.net (69.252.250.103), rcode=0 (No Error), aa=1, in 164ms
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 YES!
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20181130142416 20180802102416 29521 dnssec-failed.org. jVLGqhO4gxcP+MnVQav5ZUDW6emqcGdVhaNLcoa8+rNJrCIldUgYdVGMHyWNesWojAIEnXGEInJl5yFmkeZRp5jKpOPYmApPSrJsG5KgXBTJFWHmfnCDHi6rLRwGzuHJfqnD7caFo2pCMbbKKiGORWkmgwy/zIcbh1CEEIu7KVkZSDowg+CRDTrZx/uTMzQAsNEWunUA3yCPWEjjIRVXoeBv/115qVByzhk41cfb+ClyZhmawzC47IGSaZMDMtQpS2IccGsKa6oZpgwYwXyAPSkOrWC5sCs1t+LsbMvqdn57Ne9k3culo1i4/yUIWOcm3bhwBe7/BsH4TEXBAfXRlw==' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20180809172416 20180802141916 44973 dnssec-failed.org. raTVByMUlZ/fVaJYdfVQxfVP+hen7TPLpuX/AYBHRXwTWuOXJLXG8kfhJG9StM2n6SKNYb9ByksZQE6BgmYHj1f1bBb4tLQ8agCeMSeG2uYutLfXhYoYC1AfTqxuSm0g08KCYOSLHUlo4AOVyVWCXkri3tgt14WMWj7WxLYsJCw=' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 RRSIG - separate
  pdns_recursor[21596]: [21]    dnssec-failed.org: OPT answer '.' from 'dnssec-failed.org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating DNSKEY for dnssec-failed.org
  pdns_recursor[21596]: [21] : no TA found for 'dnssec-failed.org' among 1
  pdns_recursor[21596]: [21]     dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [21]     dnssec-failed.org: Found cache hit for DS: 106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc[ttl=60] 106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce[ttl=60] 
  pdns_recursor[21596]: [21]     dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Secure
  pdns_recursor[21596]: [21] : trying to validate 2 DNSKEYs with 1 DS
  pdns_recursor[21596]: [21] : we now have 0 DNSKEYs
  pdns_recursor[21596]: [21] : returning Bogus state from validateDNSKeys(dnssec-failed.org)
  pdns_recursor[21596]: [21] validation state was Secure, state update is Bogus, validation state is now Bogus
  pdns_recursor[21596]: [21]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]    dnssec-failed.org: answer is in: resolved to '256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: answer is in: resolved to '257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=|DNSKEY'
  pdns_recursor[21596]: [21]    dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[21596]: [21]    dnssec-failed.org: validation status is Bogus
  pdns_recursor[21596]: [21] Retrieved 0 DNSKeys for dnssec-failed.org, state is Bogus
  pdns_recursor[21596]: [21] validation state was Secure, state update is Bogus, validation state is now Bogus
  pdns_recursor[21596]: [21] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record www.dnssec-failed.org
  pdns_recursor[21596]: [21] Validating non-additional record for www.dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[21596]: [21]    dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]    dnssec-failed.org: Found cache hit for DNSKEY: 256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr[ttl=60] 257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=[ttl=60] 
  pdns_recursor[21596]: [21]    dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Bogus
  pdns_recursor[21596]: [21] Retrieved 0 DNSKeys for dnssec-failed.org, state is Bogus
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: got negative caching indication for 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [21]   www.dnssec-failed.org: status=noerror, other types may exist, but we are done (have negative SOA) (have aa bit) 
  pdns_recursor[21596]: [21] www.dnssec-failed.org: removing cut state for www.dnssec-failed.org
  pdns_recursor[21596]: [21] : list of cuts from www.dnssec-failed.org to .
  pdns_recursor[21596]:  - .: Secure
  pdns_recursor[21596]:  - org: Secure
  pdns_recursor[21596]:  - dnssec-failed.org: Secure
  pdns_recursor[21596]: [21] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 160ms
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [21] www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] : got status Secure for name org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record org
  pdns_recursor[21596]: [21] Validating DS record for org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for .
  pdns_recursor[21596]: [21]  .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]  .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=54] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=54] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=54] 
  pdns_recursor[21596]: [21]  .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [21] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [21] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [21] www.dnssec-failed.org.: Nameservers: a0.org.afilias-nst.info.(0.00ms), d0.org.afilias-nst.org.(0.00ms), b0.org.afilias-nst.org.(0.00ms), 
  pdns_recursor[21596]: [21] www.dnssec-failed.org.:              c0.org.afilias-nst.info.(62.67ms), b2.org.afilias-nst.org.(66.34ms), a2.org.afilias-nst.info.(82.27ms)
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Trying to resolve NS 'a0.org.afilias-nst.info' (1/6)
  pdns_recursor[21596]: [21]    a0.org.afilias-nst.info: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]    a0.org.afilias-nst.info: Looking for CNAME cache hit of 'a0.org.afilias-nst.info|CNAME'
  pdns_recursor[21596]: [21]    a0.org.afilias-nst.info: No CNAME cache hit of 'a0.org.afilias-nst.info|CNAME' found
  pdns_recursor[21596]: [21]    a0.org.afilias-nst.info: Found cache hit for A: 199.19.56.1[ttl=169989] 
  pdns_recursor[21596]: [21]    a0.org.afilias-nst.info: updating validation state with cache content for a0.org.afilias-nst.info to Insecure
  pdns_recursor[21596]: [21]   Nameserver a0.org.afilias-nst.info IPs: 199.19.56.1(0.00ms), 2001:500:e::1(0.00ms)
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Resolved 'org' NS a0.org.afilias-nst.info to: 199.19.56.1, 2001:500:e::1
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Trying IP 199.19.56.1:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Got 9 answers from a0.org.afilias-nst.info (199.19.56.1), rcode=0 (No Error), aa=0, in 176ms
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [21] www.dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [21] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [21] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [21] Retrieving DNSKeys for org
  pdns_recursor[21596]: [21]  org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [21]  org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=57] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=57] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=57] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=57] 
  pdns_recursor[21596]: [21]  org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [21] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [21] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [21] Secure!
  pdns_recursor[21596]: [21] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [21] www.dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [21] www.dnssec-failed.org.: Nameservers: dns103.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), dns104.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [21] www.dnssec-failed.org.:              dns105.comcast.net.(0.00ms), dns102.comcast.net.(186.06ms)
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Trying to resolve NS 'dns103.comcast.net' (1/5)
  pdns_recursor[21596]: [21]    dns103.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [21]    dns103.comcast.net: Looking for CNAME cache hit of 'dns103.comcast.net|CNAME'
  pdns_recursor[21596]: [21]    dns103.comcast.net: No CNAME cache hit of 'dns103.comcast.net|CNAME' found
  pdns_recursor[21596]: [21]    dns103.comcast.net: Found cache hit for A: 68.87.76.228[ttl=57] 
  pdns_recursor[21596]: [21]    dns103.comcast.net: updating validation state with cache content for dns103.comcast.net to Indeterminate
  pdns_recursor[21596]: [21]   Nameserver dns103.comcast.net IPs: 68.87.76.228(0.00ms), 2001:558:1014:c:68:87:76:228(0.00ms)
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns103.comcast.net to: 68.87.76.228, 2001:558:1014:c:68:87:76:228
  pdns_recursor[21596]: [21] www.dnssec-failed.org: Trying IP 68.87.76.228:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: Starting validation of answer to www.dnssec-failed.org|A for 127.0.0.1:42663
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for A
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Looking for CNAME cache hit of 'www.dnssec-failed.org|CNAME'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: No CNAME cache hit of 'www.dnssec-failed.org|CNAME' found
  pdns_recursor[21596]: [22] www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|A', trying to find an appropriate NS record
  pdns_recursor[21596]: [22] : got TA for '.'
  pdns_recursor[21596]: [22] : setting cut state for . to Secure
  pdns_recursor[21596]: [22] : - Looking for a cut at org
  pdns_recursor[21596]: [22] : no TA found for 'org' among 1
  pdns_recursor[21596]: [22]   org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [22]   org: Found cache hit for DS: 9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5[ttl=60] 9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982[ttl=60] 
  pdns_recursor[21596]: [22]   org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [22] : - Found cut at org
  pdns_recursor[21596]: [22] : New state for org is Secure
  pdns_recursor[21596]: [22] : - Looking for a cut at dnssec-failed.org
  pdns_recursor[21596]: [22] : no TA found for 'dnssec-failed.org' among 1
  pdns_recursor[21596]: [22]   dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [22]   dnssec-failed.org: Found cache hit for DS: 106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc[ttl=59] 106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce[ttl=59] 
  pdns_recursor[21596]: [22]   dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Secure
  pdns_recursor[21596]: [22] : - Found cut at dnssec-failed.org
  pdns_recursor[21596]: [22] : New state for dnssec-failed.org is Secure
  pdns_recursor[21596]: [22] : - Looking for a cut at www.dnssec-failed.org
  pdns_recursor[21596]: [22] : no TA found for 'www.dnssec-failed.org' among 1
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: No cache hit for 'www.dnssec-failed.org|DS', trying to find an appropriate NS record
  pdns_recursor[21596]: [22] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 150ms
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] Validating DS record for org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for .
  pdns_recursor[21596]: [22]    .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]    .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=56] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=56] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=56] 
  pdns_recursor[21596]: [22]    .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [22] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [22]   www.dnssec-failed.org.: Nameservers: b2.org.afilias-nst.org.(0.00ms), c0.org.afilias-nst.info.(0.00ms), a0.org.afilias-nst.info.(0.00ms), 
  pdns_recursor[21596]: [22]   www.dnssec-failed.org.:              d0.org.afilias-nst.org.(0.00ms), b0.org.afilias-nst.org.(0.00ms), a2.org.afilias-nst.info.(84.84ms)
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Trying to resolve NS 'b2.org.afilias-nst.org' (1/6)
  pdns_recursor[21596]: [22]      b2.org.afilias-nst.org: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]      b2.org.afilias-nst.org: Found cache hit for A: 199.249.120.1[ttl=169991] 
  pdns_recursor[21596]: [22]      b2.org.afilias-nst.org: updating validation state with cache content for b2.org.afilias-nst.org to Insecure
  pdns_recursor[21596]: [22]     Nameserver b2.org.afilias-nst.org IPs: 2001:500:48::1(0.00ms), 199.249.120.1(0.00ms)
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Resolved 'org' NS b2.org.afilias-nst.org to: 2001:500:48::1, 199.249.120.1
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Trying IP [2001:500:48::1]:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Got 9 answers from b2.org.afilias-nst.org (2001:500:48::1), rcode=0 (No Error), aa=0, in 935ms
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for org
  pdns_recursor[21596]: [22]    org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]    org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=58] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=58] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=58] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=58] 
  pdns_recursor[21596]: [22]    org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [22] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [22]   www.dnssec-failed.org.: Nameservers: dns102.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), dns105.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [22]   www.dnssec-failed.org.:              dns103.comcast.net.(0.00ms), dns104.comcast.net.(0.00ms)
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Trying to resolve NS 'dns102.comcast.net' (1/5)
  pdns_recursor[21596]: [22]      dns102.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]      dns102.comcast.net: Found cache hit for A: 68.87.85.132[ttl=59] 
  pdns_recursor[21596]: [22]      dns102.comcast.net: updating validation state with cache content for dns102.comcast.net to Indeterminate
  pdns_recursor[21596]: [22]     Nameserver dns102.comcast.net IPs: 2001:558:1004:7:68:87:85:132(0.00ms), 68.87.85.132(189.45ms)
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns102.comcast.net to: 2001:558:1004:7:68:87:85:132, 68.87.85.132
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Trying IP [2001:558:1004:7:68:87:85:132]:53, asking 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: Got 5 answers from dns102.comcast.net (2001:558:1004:7:68:87:85:132), rcode=0 (No Error), aa=1, in 612ms
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|SOA|dns101.comcast.org. dnsadmin.comcast.net. 2010101918 900 180 604800 7200' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|SOA 5 2 86400 20180809172416 20180802141916 44973 dnssec-failed.org. AJU3wyc+sNXYqBQtLMf8Y1uhO1pFjUDilVQUEgWuFAMlZLcEMmhUSKp6YtDRzSqr3Mbxn6FUFjlWZpJAbTqNsGRBwt1TR4nckBJnKgUC3pVTkFgaMgwtfdysaRCUJOFPk1E/9rCEsKR7pFItAjzjc0wQiGX/lXbox0bJ8SKVhNs=' from 'dnssec-failed.org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|NSEC|dnssec-failed.org. A TXT RRSIG NSEC' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 YES!
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|RRSIG|NSEC 5 3 7200 20180809172416 20180802141916 44973 dnssec-failed.org. I0tHfDfFdEoE13g7Io0T0CDeSX0CQFGlJzXzsFJviHzw8Z12ZNWQJ3tIO9EgOrsBV7r4iHok7L/jhmx+bHybj+XYac4yyIQ2gRj9/5x4vKtMdNzjHgwbo+pDtmyqMe/rWQHzt0J8NKK4VTbBqiXNDXu/u6CM+Qe5kHTU90mWtSM=' from 'dnssec-failed.org' nameservers? ttl=7200, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: OPT answer '.' from 'dnssec-failed.org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] Validating non-additional record for dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[21596]: [22]    dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]    dnssec-failed.org: No cache hit for 'dnssec-failed.org|DNSKEY', trying to find an appropriate NS record
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22]    dnssec-failed.org: initial validation status for dnssec-failed.org is Secure
  pdns_recursor[21596]: [22]    dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [22]    dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [22]    dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [22]    dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [22]    dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 146ms
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22]    dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] Validating DS record for org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for .
  pdns_recursor[21596]: [22]     .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]     .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=54] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=54] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=54] 
  pdns_recursor[21596]: [22]     .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [22] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [22]    dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [22]    dnssec-failed.org.: Nameservers: c0.org.afilias-nst.info.(0.00ms), a0.org.afilias-nst.info.(0.00ms), d0.org.afilias-nst.org.(0.00ms), 
  pdns_recursor[21596]: [22]    dnssec-failed.org.:              b0.org.afilias-nst.org.(0.00ms), b2.org.afilias-nst.org.(66.50ms), a2.org.afilias-nst.info.(82.46ms)
  pdns_recursor[21596]: [22]    dnssec-failed.org: Trying to resolve NS 'c0.org.afilias-nst.info' (1/6)
  pdns_recursor[21596]: [22]       c0.org.afilias-nst.info: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]       c0.org.afilias-nst.info: Found cache hit for A: 199.19.53.1[ttl=169989] 
  pdns_recursor[21596]: [22]       c0.org.afilias-nst.info: updating validation state with cache content for c0.org.afilias-nst.info to Insecure
  pdns_recursor[21596]: [22]      Nameserver c0.org.afilias-nst.info IPs: 199.19.53.1(0.00ms), 2001:500:b::1(831.96ms)
  pdns_recursor[21596]: [22]    dnssec-failed.org: Resolved 'org' NS c0.org.afilias-nst.info to: 199.19.53.1, 2001:500:b::1
  pdns_recursor[21596]: [22]    dnssec-failed.org: Trying IP 199.19.53.1:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [22]    dnssec-failed.org: Got 9 answers from c0.org.afilias-nst.info (199.19.53.1), rcode=0 (No Error), aa=0, in 62ms
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22]    dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for org
  pdns_recursor[21596]: [22]     org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]     org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=57] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=57] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=57] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=57] 
  pdns_recursor[21596]: [22]     org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [22] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [22]    dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [22]    dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [22]    dnssec-failed.org.: Nameservers: dns105.comcast.net.(0.00ms), dns103.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [22]    dnssec-failed.org.:              dns104.comcast.net.(0.00ms), dns102.comcast.net.(186.85ms)
  pdns_recursor[21596]: [22]    dnssec-failed.org: Trying to resolve NS 'dns105.comcast.net' (1/5)
  pdns_recursor[21596]: [22]       dns105.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]       dns105.comcast.net: Found cache hit for A: 68.87.72.244[ttl=57] 
  pdns_recursor[21596]: [22]       dns105.comcast.net: updating validation state with cache content for dns105.comcast.net to Indeterminate
  pdns_recursor[21596]: [22]      Nameserver dns105.comcast.net IPs: 68.87.72.244(0.00ms), 2001:558:100e:5:68:87:72:244(0.00ms)
  pdns_recursor[21596]: [22]    dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns105.comcast.net to: 68.87.72.244, 2001:558:100e:5:68:87:72:244
  pdns_recursor[21596]: [22]    dnssec-failed.org: Trying IP 68.87.72.244:53, asking 'dnssec-failed.org|DNSKEY'
  pdns_recursor[21596]: [22]    dnssec-failed.org: Got 5 answers from dns105.comcast.net (68.87.72.244), rcode=0 (No Error), aa=1, in 166ms
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|DNSKEY|256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 YES!
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20180809172416 20180802141916 44973 dnssec-failed.org. raTVByMUlZ/fVaJYdfVQxfVP+hen7TPLpuX/AYBHRXwTWuOXJLXG8kfhJG9StM2n6SKNYb9ByksZQE6BgmYHj1f1bBb4tLQ8agCeMSeG2uYutLfXhYoYC1AfTqxuSm0g08KCYOSLHUlo4AOVyVWCXkri3tgt14WMWj7WxLYsJCw=' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 RRSIG - separate
  pdns_recursor[21596]: [22]    dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DNSKEY 5 2 3600 20181130142416 20180802102416 29521 dnssec-failed.org. jVLGqhO4gxcP+MnVQav5ZUDW6emqcGdVhaNLcoa8+rNJrCIldUgYdVGMHyWNesWojAIEnXGEInJl5yFmkeZRp5jKpOPYmApPSrJsG5KgXBTJFWHmfnCDHi6rLRwGzuHJfqnD7caFo2pCMbbKKiGORWkmgwy/zIcbh1CEEIu7KVkZSDowg+CRDTrZx/uTMzQAsNEWunUA3yCPWEjjIRVXoeBv/115qVByzhk41cfb+ClyZhmawzC47IGSaZMDMtQpS2IccGsKa6oZpgwYwXyAPSkOrWC5sCs1t+LsbMvqdn57Ne9k3culo1i4/yUIWOcm3bhwBe7/BsH4TEXBAfXRlw==' from 'dnssec-failed.org' nameservers? ttl=3600, place=1 RRSIG - separate
  pdns_recursor[21596]: [22]    dnssec-failed.org: OPT answer '.' from 'dnssec-failed.org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] Validating DNSKEY for dnssec-failed.org
  pdns_recursor[21596]: [22] : no TA found for 'dnssec-failed.org' among 1
  pdns_recursor[21596]: [22]     dnssec-failed.org: Wants DNSSEC processing, auth data in query for DS
  pdns_recursor[21596]: [22]     dnssec-failed.org: Found cache hit for DS: 106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce[ttl=60] 106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc[ttl=60] 
  pdns_recursor[21596]: [22]     dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Secure
  pdns_recursor[21596]: [22] : trying to validate 2 DNSKEYs with 1 DS
  pdns_recursor[21596]: [22] : we now have 0 DNSKEYs
  pdns_recursor[21596]: [22] : returning Bogus state from validateDNSKeys(dnssec-failed.org)
  pdns_recursor[21596]: [22] validation state was Secure, state update is Bogus, validation state is now Bogus
  pdns_recursor[21596]: [22]    dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]    dnssec-failed.org: answer is in: resolved to '257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=|DNSKEY'
  pdns_recursor[21596]: [22]    dnssec-failed.org: answer is in: resolved to '256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr|DNSKEY'
  pdns_recursor[21596]: [22]    dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[21596]: [22]    dnssec-failed.org: validation status is Bogus
  pdns_recursor[21596]: [22] Retrieved 0 DNSKeys for dnssec-failed.org, state is Bogus
  pdns_recursor[21596]: [22] validation state was Secure, state update is Bogus, validation state is now Bogus
  pdns_recursor[21596]: [22] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record www.dnssec-failed.org
  pdns_recursor[21596]: [22] Validating non-additional record for www.dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[21596]: [22]    dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]    dnssec-failed.org: Found cache hit for DNSKEY: 257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=[ttl=60] 256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr[ttl=60] 
  pdns_recursor[21596]: [22]    dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Bogus
  pdns_recursor[21596]: [22] Retrieved 0 DNSKeys for dnssec-failed.org, state is Bogus
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: got negative caching indication for 'www.dnssec-failed.org|DS'
  pdns_recursor[21596]: [22]   www.dnssec-failed.org: status=noerror, other types may exist, but we are done (have negative SOA) (have aa bit) 
  pdns_recursor[21596]: [22] www.dnssec-failed.org: removing cut state for www.dnssec-failed.org
  pdns_recursor[21596]: [22] : list of cuts from www.dnssec-failed.org to .
  pdns_recursor[21596]:  - .: Secure
  pdns_recursor[21596]:  - org: Secure
  pdns_recursor[21596]:  - dnssec-failed.org: Secure
  pdns_recursor[21596]: [22] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] www.dnssec-failed.org: initial validation status for www.dnssec-failed.org is Secure
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Cache consultations done, have 1 NS to contact
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Domain has hardcoded nameserver
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Resolved '.' NS (empty) to: 142.4.205.47
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Trying IP 142.4.205.47:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Got 22 answers from (empty) (142.4.205.47), rcode=0 (No Error), aa=0, in 259ms
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|a0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|b2.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|a2.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|c0.org.afilias-nst.info.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|d0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|NS|b0.org.afilias-nst.org.' from '.' nameservers? ttl=172800, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|DS|9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|DS|9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982' from '.' nameservers? ttl=86400, place=2 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'org|RRSIG|DS 8 1 86400 20180904100448 20180805100448 52335 . hzqnWh7cwILNn77FqpNpMzv1dcy5dcXRbz18VUVV/kxVekCztGl3tpA+jVVFGzIK47d/uKXo11uOK7c+aQOz3TVlbaFLw6q+kI29DjzCG6ugSHyUs6HgbyuoaRN/2DKIOEp+ADrIFmy92321SOw7IJxoISGIJd/fuBVZqYmAgJncHKEZGk7o5gOGByYbFN4pusZWldeGvQIzpK8iEqbtKHj60xfwohCfeEkTw72uYNeRAE47TjOf5Y4lgouFjp8Egv5QZ5TGsyxdK05R9yfD6XlCi3K5fBSHyYJibbo11lvs15x5iuJm1qizM6jOArW3j/YjgF8TybrxrKJjMiYolw==' from '.' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|A|199.19.56.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'a0.org.afilias-nst.info|AAAA|2001:500:e::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|A|199.249.112.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'a2.org.afilias-nst.info|AAAA|2001:500:40::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|A|199.19.54.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'b0.org.afilias-nst.org|AAAA|2001:500:c::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|A|199.249.120.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'b2.org.afilias-nst.org|AAAA|2001:500:48::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|A|199.19.53.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'c0.org.afilias-nst.info|AAAA|2001:500:b::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|A|199.19.57.1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'd0.org.afilias-nst.org|AAAA|2001:500:f::1' from '.' nameservers? ttl=172800, place=3 YES! - This answer was received from a server we forward to.
  pdns_recursor[21596]: [22] www.dnssec-failed.org: OPT answer '.' from '.' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] : got status Secure for name org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record org
  pdns_recursor[21596]: [22] Validating DS record for org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for .
  pdns_recursor[21596]: [22]  .: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]  .: Found cache hit for DNSKEY: 256 3 8 AwEAAd6O7xBWOKRnYqjFHvD2aGWFXHsoKUNdkk/zjVcFewfrXnMzqal0NbMuf99MvJiA/uTS2Qn8vjWqOO+nTDGLyzmYXdKavFFt2YnQ5b7cbmmBIQdVxAuYmdjZttnIoCV1+2Xgoki417wRoR+pPzqpSWpHEwCceTra5vCSfFjjXjLbNp2b5wRpOppvkNMx9huTZqbzdQrmKwEhct+rY4EJ847a+tffl7D5s1aEA5akekeW51mHPvcHh1+jbfAboOQr15i98sZSYdmCWHNVty6NDfEdN9JPq4w+AtvBviEbkrN2bfoVSshuIPczdv7rS/XZwMA5ST3o6hDd6H/AkXrcyWU=[ttl=53] 256 3 8 AwEAAbAlOB1GLpAgYjGEKCxApUhQnoFrJyXdvfvrWE1ZLN2xcuii79Q9IkP/pvdKmRzPAr1QOouCtvZcm9i+pILDa2aaYzdJuVPK3U52Bf3dGMcpAUImoV0Lf47o9luY609b7hfgWdmPJH8uR6RHZNLAcrOywiaFz1vDoaxbGdCz9ckeZw6Ab2Ayji2Iyyxn6vMb9s+asSSLFpzSYYU/9iHRXGPNEh1XxjTxqdte06H+emGvj3ORYXY2g1F00HeQcJKUKCIlW5C3RWX9o8uHOPCnE80civHc88VmwwUi16C7n9lUxTbvdXYBlG182CGDIJ5iy4+u45PF06CM01YiNbC+oqM=[ttl=53] 257 3 8 AwEAAaq+qqsdDHByq/DFR5/u23qcDNOQJzjYBcSfjrGNLdY2+vY+ubhuiz0hG1xk5D+dK78Eh58wZ3tQnsRr3bVNVfcovlx/rdwuw5blez2TT0Et4IF/3b/RpMpCwSSOWTMGvi0EwIMNsjYWEZlRjcWku3cnAAvSD3YdaRW2JCKsbkK5OQp2YjuQgIOL7J6f8mN6nkfAWd9L2U9H+TSEnx8gqqkXIEIRWcbdWN1FiCdy3L8CaHbZcttzx5lLOGrjPW+raXn+KaQSU+WW9n2PPOZbNUrQnsW/DJ+b+soNQQbhwFlp/av5VzaxB7/57vEKqj71x+Xu8S0sGpLcXrkf5p3ri93ScLsJOT11fIlMRIwcKsWZEIIyYzuQeq8MoVTenvN6re/y872Vb6JBHbBMk0JmsRwkXltz9PINWyvVyqM3PA1bJ4fz8QbqXnTnJiR/yylhcE8rjPUtnf29NyDN7Co9JzPwnwE74F3k3R18w45L8E5Dt5it2PIA9/rb6GDMrPAPsa1X82qNLzcboosMj9vT7Ofg8M+x2/VYt6u4xX4glZRavyjTs6qGfzFS+Z44zrIP4CtNa0fL0AwJ/wsK4YJSX0xZ6/CJI/NNXeSgG5vfMw04kUDI9d9oO9jkAhYDmTaOI6C5nVTymAs3uje8/mZlo/pUSllB0DkpTgd5PTAwQsA1[ttl=53] 
  pdns_recursor[21596]: [22]  .: updating validation state with cache content for . to Secure
  pdns_recursor[21596]: [22] Retrieved 3 DNSKeys for ., state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 3 keys for org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name d0.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record d0.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name b2.org.afilias-nst.org (from org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record b2.org.afilias-nst.org
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name c0.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record c0.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22] : got status Secure for name a2.org.afilias-nst.info (from .)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record a2.org.afilias-nst.info
  pdns_recursor[21596]: [22] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'a0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'b2.org.afilias-nst.org.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'a2.org.afilias-nst.info.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'c0.org.afilias-nst.info.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'd0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'org' -> 'b0.org.afilias-nst.org.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got DS record 'org' -> '9795 7 2 3922b31b6f3a4ea92b19eb7b52120f031fd8e05ff0b03bafcf9f891bfe7ff8e5'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got DS record 'org' -> '9795 7 1 364dfab3daf254cab477b5675b10766ddaa24982'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: status=did not resolve, got 6 NS, looping to them
  pdns_recursor[21596]: [22] www.dnssec-failed.org.: Nameservers: d0.org.afilias-nst.org.(0.00ms), b0.org.afilias-nst.org.(0.00ms), a0.org.afilias-nst.info.(0.00ms), 
  pdns_recursor[21596]: [22] www.dnssec-failed.org.:              c0.org.afilias-nst.info.(62.30ms), b2.org.afilias-nst.org.(65.95ms), a2.org.afilias-nst.info.(81.79ms)
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Trying to resolve NS 'd0.org.afilias-nst.org' (1/6)
  pdns_recursor[21596]: [22]    d0.org.afilias-nst.org: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]    d0.org.afilias-nst.org: Looking for CNAME cache hit of 'd0.org.afilias-nst.org|CNAME'
  pdns_recursor[21596]: [22]    d0.org.afilias-nst.org: No CNAME cache hit of 'd0.org.afilias-nst.org|CNAME' found
  pdns_recursor[21596]: [22]    d0.org.afilias-nst.org: Found cache hit for A: 199.19.57.1[ttl=169988] 
  pdns_recursor[21596]: [22]    d0.org.afilias-nst.org: updating validation state with cache content for d0.org.afilias-nst.org to Insecure
  pdns_recursor[21596]: [22]   Nameserver d0.org.afilias-nst.org IPs: 199.19.57.1(0.00ms), 2001:500:f::1(0.00ms)
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Resolved 'org' NS d0.org.afilias-nst.org to: 199.19.57.1, 2001:500:f::1
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Trying IP 199.19.57.1:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Got 9 answers from d0.org.afilias-nst.org (199.19.57.1), rcode=0 (No Error), aa=0, in 220ms
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns101.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns103.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns102.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns105.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|NS|dns104.comcast.net.' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|DS|106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce' from 'org' nameservers? ttl=86400, place=2 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'dnssec-failed.org|RRSIG|DS 7 2 86400 20180822153117 20180801143117 1862 org. LfCHiRxVj7rqqPm1F+oRg0rZT2HRvlaE8HAchOX+bPPtY6qDmVH5XVVWvkoI0AcHy/Gw4Qs4R2o5TNiC7tc0jxU9NAyhTxz4q/CxZ0qRYx8JAV6H+lwJfi+HcaGwtaw6dlZAWzd0jer4Nn+i7VIHZhcCWJ9d82Jcqj82R+zyTfo=' from 'org' nameservers? ttl=86400, place=2 RRSIG - separate
  pdns_recursor[21596]: [22] www.dnssec-failed.org: OPT answer '.' from 'org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] : got status Secure for name dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record dnssec-failed.org
  pdns_recursor[21596]: [22] Validating DS record for dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for org
  pdns_recursor[21596]: [22]  org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]  org: Found cache hit for DNSKEY: 256 3 7 AwEAAXxsMmN/JgpEE9Y4uFNRJm7Q9GBwmEYUCsCxuKlgBU9WrQEFRrvAeMamUBeX4SE8s3V/TEk/TgGmPPp0pMkKD7mseluK6Ard2HZ6O3nPAzL4i8py/UDRUmYNSCxwfdfjUWRmcB9H+NKWMsJoDhAkLFqg5HS7f0j4Vb99Wac24Fk7[ttl=56] 256 3 7 AwEAAcLdAPt3vn/ND00zZlyTx7OBko+9YeCrSl2eGuEXjef0Lqf0tKGikoHwnmTHtT8J/aGqkZImLMVByJbknE0wKDnbvbKDoTQxPwUQZLH6k3sTdsPKESKDSBSc6VFMq35gx6CeuRYZ9KkGWiUsKqJhXPo6tyJFCBxfaNQQyrzBnv4/[ttl=56] 257 3 7 AwEAAZTjbIO5kIpxWUtyXc8avsKyHIIZ+LjC2Dv8naO+Tz6X2fqzDC1bdq7HlZwtkaqTkMVVJ+8gE9FIreGJ4c8G1GdbjQgbP1OyYIG7OHTc4hv5T2NlyWr6k6QFz98Q4zwFIGTFVvwBhmrMDYsOTtXakK6QwHovA1+83BsUACxlidpwB0hQacbD6x+I2RCDzYuTzj64Jv0/9XsX6AYV3ebcgn4hL1jIR2eJYyXlrAoWxdzxcW//5yeL5RVWuhRxejmnSVnCuxkfS4AQ485KH2tpdbWcCopLJZs6tw8q3jWcpTGzdh/v3xdYfNpQNcPImFlxAun3BtORPA2r8ti6MNoJEHU=[ttl=56] 257 3 7 AwEAAcMnWBKLuvG/LwnPVykcmpvnntwxfshHlHRhlY0F3oz8AMcuF8gw9McCw+BoC2YxWaiTpNPuxjSNhUlBtcJmcdkz3/r7PIn0oDf14ept1Y9pdPh8SbIBIWx50ZPfVRlj8oQXv2Y6yKiQik7bi3MT37zMRU2kw2oy3cgrsGAzGN4s/C6SFYon5N1Q2O4hGDbeOq538kATOy0GFELjuauV9guX/431msYu4Rgb5lLuQ3Mx5FSIxXpI/RaAn2mhM4nEZ/5IeRPKZVGydcuLBS8GZlxW4qbb8MgRZ8bwMg0pqWRHmhirGmJIt3UuzvN1pSFBfX7ysI9PPhSnwXCNDXk0kk0=[ttl=56] 
  pdns_recursor[21596]: [22]  org: updating validation state with cache content for org to Secure
  pdns_recursor[21596]: [22] Retrieved 4 DNSKeys for org, state is Secure
  pdns_recursor[21596]: [22] Going to validate 2 record contents with 1 sigs and 4 keys for dnssec-failed.org
  pdns_recursor[21596]: [22] Secure!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns101.comcast.net.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns103.comcast.net.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns102.comcast.net.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns105.comcast.net.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got NS record 'dnssec-failed.org' -> 'dns104.comcast.net.'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 1 4f219dce274f820ea81ea1150638dabe21eb27fc'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: got DS record 'dnssec-failed.org' -> '106 5 2 ae3424c9b171af3b202203767e5703426130d76ef6847175f2eed355f86ef1ce'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: status=did not resolve, got 5 NS, looping to them
  pdns_recursor[21596]: [22] www.dnssec-failed.org.: Nameservers: dns103.comcast.net.(0.00ms), dns101.comcast.net.(0.00ms), dns104.comcast.net.(0.00ms), 
  pdns_recursor[21596]: [22] www.dnssec-failed.org.:              dns105.comcast.net.(0.00ms), dns102.comcast.net.(184.82ms)
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Trying to resolve NS 'dns103.comcast.net' (1/5)
  pdns_recursor[21596]: [22]    dns103.comcast.net: Wants DNSSEC processing, NO auth data in query for A
  pdns_recursor[21596]: [22]    dns103.comcast.net: Looking for CNAME cache hit of 'dns103.comcast.net|CNAME'
  pdns_recursor[21596]: [22]    dns103.comcast.net: No CNAME cache hit of 'dns103.comcast.net|CNAME' found
  pdns_recursor[21596]: [22]    dns103.comcast.net: Found cache hit for A: 68.87.76.228[ttl=56] 
  pdns_recursor[21596]: [22]    dns103.comcast.net: updating validation state with cache content for dns103.comcast.net to Indeterminate
  pdns_recursor[21596]: [22]   Nameserver dns103.comcast.net IPs: 68.87.76.228(0.00ms), 2001:558:1014:c:68:87:76:228(0.00ms)
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Resolved 'dnssec-failed.org' NS dns103.comcast.net to: 68.87.76.228, 2001:558:1014:c:68:87:76:228
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Trying IP 68.87.76.228:53, asking 'www.dnssec-failed.org|A'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: Got 4 answers from dns103.comcast.net (68.87.76.228), rcode=0 (No Error), aa=1, in 212ms
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|A|68.87.109.242' from 'dnssec-failed.org' nameservers? ttl=7200, place=1 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|A|69.252.193.191' from 'dnssec-failed.org' nameservers? ttl=7200, place=1 YES!
  pdns_recursor[21596]: [22] www.dnssec-failed.org: accept answer 'www.dnssec-failed.org|RRSIG|A 5 3 7200 20180809172416 20180802141916 44973 dnssec-failed.org. hN87Z8vRdjvF7jItkveX5Ln/Nnc3Mar8dpKG095TGSacuKxddeuWRcvDl2QzcPYxslWOmmTknrkfReWQ3QINoGEbIXwLfX88srdBXn11HwHlIXPvc3Ys8kZgLJoWlWOuzebA0qlpDgr3uUz08+ty39UCp1s8Vzq7KX+j9OdWXNk=' from 'dnssec-failed.org' nameservers? ttl=7200, place=1 RRSIG - separate
  pdns_recursor[21596]: [22] www.dnssec-failed.org: OPT answer '.' from 'dnssec-failed.org' nameservers
  pdns_recursor[21596]: [22] : got status Secure for name www.dnssec-failed.org (from dnssec-failed.org)
  pdns_recursor[21596]: [22] : got initial zone status Secure for record www.dnssec-failed.org
  pdns_recursor[21596]: [22] Validating non-additional record for www.dnssec-failed.org
  pdns_recursor[21596]: [22] Retrieving DNSKeys for dnssec-failed.org
  pdns_recursor[21596]: [22]  dnssec-failed.org: Wants DNSSEC processing, auth data in query for DNSKEY
  pdns_recursor[21596]: [22]  dnssec-failed.org: Found cache hit for DNSKEY: 257 3 5 AwEAAb/f/pB/FLWoYp3j+HtldGkbUMT6caAw2rej0DZkgXVFOKn4PWi3BYjCozjEqxeramt+9b1SMuOSJ8vGKWr0YKrfyfJigsVxpsMgJ7QWcxeMACjC/oM8BPjDFBby/CgQQE63nPVX2SfDWCRhEhTOnsPZpKJvq66IHF/w+3u0IpyeplQWvO+HJ9OQPOQrstM7d/IPa7yKEtqS2nhBT0GWX2/GYhT6oE7F4vc2VF9f6MjpB/pWPzkcx636YaxG9P0QRBvzdD/Wztcbz1Scgxw5sUlIkQAzWV1mJfvXF+7NqzGcc94/kMt1VUzN2kYASRyn1ALiFPfNLz4VMUvSw5fpNS0=[ttl=59] 256 3 5 AwEAAewq/QcrsNX3C/nAAWyNY74f/q9Rb2dGLc3LOIkQBATwzIcDTDHNRjtRDxjquImNpoDKybI2hZ2e8mNKvCK/F/QXV5LafLwSzscqwvzJxEGZUA+JuiGu6kq/8OjE6EEAdYlk4ztN6OWfwuqj4ZolBjKPXCPodYvhj8gl7kqpopqr[ttl=59] 
  pdns_recursor[21596]: [22]  dnssec-failed.org: updating validation state with cache content for dnssec-failed.org to Bogus
  pdns_recursor[21596]: [22] Retrieved 0 DNSKeys for dnssec-failed.org, state is Bogus
  pdns_recursor[21596]: [22] validation state was Secure, state update is Bogus, validation state is now Bogus
  pdns_recursor[21596]: [22] www.dnssec-failed.org: determining status after receiving this packet
  pdns_recursor[21596]: [22] www.dnssec-failed.org: answer is in: resolved to '68.87.109.242|A'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: answer is in: resolved to '69.252.193.191|A'
  pdns_recursor[21596]: [22] www.dnssec-failed.org: status=got results, this level of recursion done
  pdns_recursor[21596]: [22] www.dnssec-failed.org: validation status is Bogus
  pdns_recursor[21596]: Starting validation of answer to www.dnssec-failed.org|A for 127.0.0.1:42663
  pdns_recursor[21596]: Answer to www.dnssec-failed.org|A for 127.0.0.1:42663 validates as Bogus
  pdns_recursor[21596]: Sending out SERVFAIL for www.dnssec-failed.org|A because recursor or query demands it for Bogus results