Use of stale data during dnssec validation

Today, we had a case where one of our resolvers (9.16.37) failed to return an SOA-record for the TLD 'us'. digging with the +cd flag, returned a value, while delving with +vtrace failed: ;; fetch: us/SOA ;; resolution failed: SERVFAIL Fingers pointed to a failure to validate. I dumped the cach

Tools for parsing a dumped cache

The first thing I do when I'm trying to diagnose strange behavior of a resolver, is I dump the cache to a file. Later, I end up trolling through it with less and grep, looking for entries (usually incorrect RRSIG or DS records) which will explain the behavior I saw. I have two questions: Is t