Resolutions fail only for certain areas that have been signed.
Probable causes
- DNSSEC trust chain
- Invalid SD
- clock or validator
Verifications.
- Limit the impact. — Identify whether a post, service or whole site is concerned.
- Collecting Evidence. — Keep the message accurate, time and associated newspapers.
- Test the the simplest hypothesis. — Compare with equipment or functional path.
- Correct and validate. — Apply one change at a time and retester.
Commands
Resolve-DnsName example.com -DnssecOkSolutions.
- Correct the confirmed cause rather than the symptom.
- Document the change and result.
- Establish supervision if the defect can recur.
When to climb?
Cadader if the impact extends, if the data are at risk or if the cause involves irreversible modification.