On Fri, Aug 14, 2026 at 09:27:44PM +0200, Marco Moock via mailop wrote:
> It is recommended to do DNSSEC checks, but be aware some sites (still) have
> broken DNSSEC and that behaves like a DNS failure if you enable DNSSEC
> checks.
The domains with broken DNSSEC are simply broken, mostly parked unused.
DNSSEC is on by default for queries via e.g. Cloudflare, Google, Quad9,
... There are also domains with non-existent or non-responsive NS
servers, incorrect zone data, ... Rule of thumb, ~1% of domains are
at any moment broken for some reason or other.
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
