DNSSEC_INSECURE_ISLAND

warning

This delegation is unsigned beneath a signed parent, so DNSSEC protection stops here.

Working today, and one change away from not working.

How we know

insecure-island.test
Unsigned child delegated from the signed parent with no DS. Must read as insecure, never as bogus — the remedies differ completely.
island.secure.test
A sub-delegation with no DS beneath a signed secure.test. The org-domain case above cannot exercise the code, because the evaluator guards on the parent not being a public suffix — without that guard the finding is true of most of the internet.