On 2020/11/01 17:55 , Andrew Sullivan wrote: > You basically > have two choices: do DNSSEC validation on your endpoint and probably > fail some of the time, Can you explain how DNSSEC validation would fail behind DNS64 if all queries are sent with both DO and CD set?