Exclude a domain from DNSSEC validation, like Unbound's "domain-insecure".

[Tony Finch]

Jan-Piet Mens <jpmens.dns at gmail.com> wrote:
>
> From a Comcast talk at SATIN 2012 I believe they called that a "negative
> trust anchor", and IIRC, the author wanted to publish a draft of its
> operation.

http://tools.ietf.org/html/draft-livingood-negative-trust-anchors

There has been a lot of discussion on the IETF dnsop working group mailing
list: http://www.ietf.org/mail-archive/web/dnsop/current/threads.html

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
German Bight, Humber: Southwest 5 to 7, becoming variable 3 or 4, then
northeast 4 or 5 later in Humber. Moderate or rough, becoming slight or
moderate later. Occasional rain. Moderate or good.