Can't validate `k.root-servers.net A` with minimization off and cold cache.
Reproducer:
option('NO_MINIMIZE', true)
-- maybe wait a bit for priming to end
cache.clear()
verbose(true)
-- dig +dnssec @resolver k.root-servers.net A
[00000.00][plan] plan 'k.root-servers.net.' type 'A' uid [35628.00]
[35628.00][iter] 'k.root-servers.net.' type 'A' new uid was assigned .01, parent uid .00
[35628.01][resl] => using root hints
[35628.01][iter] 'k.root-servers.net.' type 'A' new uid was assigned .02, parent uid .00
[35628.02][resl] >< TA: '.'
[35628.02][plan] plan '.' type 'DNSKEY' uid [35628.03]
[35628.03][iter] '.' type 'DNSKEY' new uid was assigned .04, parent uid .02
[35628.04][resl] => id: '54250' querying: '2001:500:a8::e#00053' score: 10 zone cut: '.' qname: '.' qtype: 'DNSKEY' proto: 'udp'
[35628.04][resl] => id: '54250' querying: '192.203.230.10#00053' score: 10 zone cut: '.' qname: '.' qtype: 'DNSKEY' proto: 'udp'
[35628.04][iter] <= rcode: NOERROR
[35628.04][vldr] <= parent: updating DNSKEY
[35628.04][vldr] <= answer valid, OK
[35628.04][cach] => stashed . DNSKEY, rank 060, 824 B total, incl. 1 RRSIGs
[ta_signal_query] signalling query trigered: _ta-4f66.
[35628.04][resl] <= server: '2001:500:a8::e' rtt: >= 229 ms
[35628.04][resl] <= server: '192.203.230.10' rtt: 29 ms
[35628.02][iter] 'k.root-servers.net.' type 'A' new uid was assigned .05, parent uid .00
[35628.05][resl] => id: '03562' querying: '192.203.230.10#00053' score: 29 zone cut: '.' qname: 'K.roOt-seRVers.NEt.' qtype: 'A' proto: 'udp'
[00000.00][plan] plan '_ta-4f66.' type 'NULL' uid [65566.00]
[65566.00][iter] '_ta-4f66.' type 'NULL' new uid was assigned .01, parent uid .00
[65566.01][resl] => using root hints
[65566.01][iter] '_ta-4f66.' type 'NULL' new uid was assigned .02, parent uid .00
[65566.02][resl] >< TA: '.'
[65566.02][plan] plan '.' type 'DNSKEY' uid [65566.03]
[65566.03][iter] '.' type 'DNSKEY' new uid was assigned .04, parent uid .02
[65566.04][cach] => satisfied by exact RRset: rank 060, new TTL 172800
[65566.04][iter] <= rcode: NOERROR
[65566.04][vldr] <= parent: updating DNSKEY
[65566.04][vldr] <= answer valid, OK
[65566.02][iter] '_ta-4f66.' type 'NULL' new uid was assigned .05, parent uid .00
[65566.05][resl] => id: '37696' querying: '2001:500:2f::f#00053' score: 10 zone cut: '.' qname: '_ta-4F66.' qtype: 'NULL' proto: 'udp'
[35628.05][iter] <= rcode: NOERROR
[35628.05][vldr] >< cut changed, needs revalidation
[35628.05][resl] <= server: '192.203.230.10' rtt: 21 ms
[35628.05][resl] => resuming yielded answer
[35628.05][vldr] >< no valid RRSIGs found: k.root-servers.net. A (0 matching RRSIGs, 0 expired, 0 not yet valid, 0 invalid signer, 0 invalid label count, 0 invalid key, 0 invalid crypto, 0 invalid NSEC)
[35628.05][plan] plan 'net.' type 'DS' uid [35628.06]
[35628.06][iter] 'net.' type 'DS' new uid was assigned .07, parent uid .05
[35628.07][resl] => id: '15869' querying: '2001:500:1::53#00053' score: 10 zone cut: '.' qname: 'NEt.' qtype: 'DS' proto: 'udp'
[65566.05][resl] => id: '37696' querying: '192.5.5.241#00053' score: 10 zone cut: '.' qname: '_ta-4F66.' qtype: 'NULL' proto: 'udp'
[35628.07][resl] => id: '15869' querying: '198.97.190.53#00053' score: 10 zone cut: '.' qname: 'NEt.' qtype: 'DS' proto: 'udp'
[65566.05][iter] <= rcode: NXDOMAIN
[65566.05][vldr] <= answer valid, OK
[65566.05][cach] => stashed . NSEC, rank 060, 308 B total, incl. 1 RRSIGs
[65566.05][cach] => stashed . SOA, rank 060, 358 B total, incl. 1 RRSIGs
[65566.05][cach] => nsec_p stashed for . (new, hash: 0)
[65566.05][resl] <= server: '2001:500:2f::f' rtt: >= 225 ms
[65566.05][resl] <= server: '192.5.5.241' rtt: 25 ms
[65566.05][resl] AD: request classified as SECURE
[65566.05][resl] finished: 4, queries: 2, mempool: 98352 B
[35628.07][iter] <= rcode: NOERROR
[35628.07][vldr] <= DS: OK
[35628.07][vldr] <= parent: updating DS
[35628.07][vldr] <= answer valid, OK
[35628.07][cach] => stashed net. DS, rank 060, 330 B total, incl. 1 RRSIGs
[35628.07][resl] <= server: '2001:500:1::53' rtt: >= 250 ms
[35628.07][resl] <= server: '198.97.190.53' rtt: 50 ms
[35628.05][resl] >< TA: '.'
[35628.05][resl] => resuming yielded answer
[35628.05][vldr] >< no valid RRSIGs found: k.root-servers.net. A (0 matching RRSIGs, 0 expired, 0 not yet valid, 0 invalid signer, 0 invalid label count, 0 invalid key, 0 invalid crypto, 0 invalid NSEC)
[35628.05][plan] plan 'net.' type 'DS' uid [35628.08]
[35628.08][iter] 'net.' type 'DS' new uid was assigned .09, parent uid .05
[35628.09][cach] => satisfied by exact RRset: rank 060, new TTL 86400
[35628.09][iter] <= rcode: NOERROR
[35628.09][vldr] <= DS: OK
[35628.09][vldr] <= parent: updating DS
[35628.09][vldr] <= answer valid, OK
[35628.05][resl] >< TA: '.'
[35628.05][resl] => resuming yielded answer
[35628.05][vldr] >< no valid RRSIGs found: k.root-servers.net. A (0 matching RRSIGs, 0 expired, 0 not yet valid, 0 invalid signer, 0 invalid label count, 0 invalid key, 0 invalid crypto, 0 invalid NSEC)
[35628.05][vldr] <= continuous revalidation, fails
[35628.05][cach] => stashed k.root-servers.net. A, rank 027, 20 B total, incl. 0 RRSIGs
[35628.05][cach] => not overwriting A k.root-servers.net.
[35628.00][resl] request failed, answering with empty SERVFAIL
[35628.05][resl] finished: 8, queries: 3, mempool: 49200 B
And we get an empty SERVFAIL as an answer. :(