Use a DNSSEC-validating resolver

I just discovered that my site was down for a huge swathe of users, even though Checkly was reporting that everything was A-OK. After investigating, it turns out that my DNSSEC configuration was broken (my provider completely lost the DNSKEY records somehow), so any user with a resolver that validates DNSSEC (including 1.1.1.1 and 8.8.8.8) couldn’t access the site.

However, it seems that Checkly doesn’t use a validating resolver, since it continued to be able to resolve the DNS lookup and complete the check successfully for the duration of the outage. This is a significant hole in my alerting and it would have been helpful if Checkly had noticed. (Yes, I know that the utility of DNSSEC is dubious, but since I have it I would like to know if it causes things to break.)