When a broken DNSSEC rollover took down the .AL top-level domain, we deployed a Negative Trust Anchor on 1.1.1.1 to keep sites reachable. Now, clients do not have to guess if validation was skipped: 1.1.1.1 returns EDE 33, a new error code signaling that validation was temporarily skipped. https://blog.cloudflare.com/dnssec-nta-ede-33/