Notes · dnssec

Signing a zone your own resolvers answer converts a soft failure into a hard one: a validating resolver returns SERVFAIL, and the name dies everywhere at once.