@jwildeboer@social.wildeboer.net Considering my not DNSSEC-signed .de domain is also affected, this is at least partially incorrect. The problem seems to be with DNSSEC records at the .de level, where I have no control over whether they are signed or not.