The problem 2 Resolving in DNSSEC can yield bogus data Bogus data is not given to an application (SERVFAIL) So either you: get an answer or you don't Sometimes you want to know what is wrong security, debugging, curiosity, ... Resolver should not make this decision for you!