ok.dnssec.dnsp.co
Three signed names: one correct, one corrupted, one expired.
What it does
A validating resolver checks signatures and refuses to hand you an answer that fails. One that merely forwards DNSSEC records will pass the broken ones straight through. Comparing the three names tells you which kind you have.
Example
$ dig ok.dnssec.dnsp.co +short
198.51.100.42
$ dig bad.dnssec.dnsp.co
;; ->>HEADER<<- status: SERVFAIL
$ dig expired.dnssec.dnsp.co
;; ->>HEADER<<- status: SERVFAIL
Reading the answer
ok resolves, bad and expired SERVFAIL
Your resolver validates.
all three resolve
Signatures are being carried but never checked.
all three fail
Something is blocking DNSSEC records outright.
Notes
- Add +dnssec to see the signature records themselves.
- A validating stub on your own machine can mask what the upstream resolver does.