TFW you just want to check your #bind config and end up having it rotate your #DNSSEC keys without warning. 8 hours later, several public resolvers still cache the bad responses. sigh