It's always DNS: systemd-resolved and broken DNSSEC somewhere

koos@moore:~$ resolvectl status
Global
       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported
resolv.conf mode: stub

Link 2 (enp43s0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS
                DNSSEC=allow-downgrade/supported

Link 3 (wlp0s20f3)
    Current Scopes: DNS
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS
                    DNSSEC=allow-downgrade/supported
Current DNS Server: 2a10:3781:1669:42::18
       DNS Servers: 10.42.2.1 2a10:3781:1669:42::18
        DNS Domain: idefix.net koos.koffie.dot
koos@moore:~$ host monitoring.solaredge.com 2a10:3781:1669:42::18
Using domain server:
Name: 2a10:3781:1669:42::18
Address: 2a10:3781:1669:42::18#53
Aliases:

monitoring.solaredge.com is an alias for nt1f5.solaredge.com.
nt1f5.solaredge.com is an alias for 0fc253cdddaf4e9c9a5c7d2913a32eb0.v1.radwarecloud.net.
0fc253cdddaf4e9c9a5c7d2913a32eb0.v1.radwarecloud.net has address 66.22.36.207
koos@moore:~$ host monitoring.solaredge.com
Host monitoring.solaredge.com not found: 2(SERVFAIL)

koos@moore:~$ resolvectl query monitoring.solaredge.com
monitoring.solaredge.com: resolve call failed: DNSSEC validation failed: missing-key

koos@moore:~$ delv @2a10:3781:1669:42::18 monitoring.solaredge.com a
;; validating d7462bb20dc049559020c76d67da418b.v1.radwarecloud.net/A: no valid signature found
; unsigned answer
monitoring.solaredge.com. 60    IN  CNAME   digf5.solaredge.com.
digf5.solaredge.com.    60  IN  CNAME   d7462bb20dc049559020c76d67da418b.v1.radwarecloud.net.
d7462bb20dc049559020c76d67da418b.v1.radwarecloud.net. 94 IN A 66.22.36.212
d7462bb20dc049559020c76d67da418b.v1.radwarecloud.net. 94 IN RRSIG A 8 4 600 20240605203132 20240514203132 8131 radwarecloud.net. mapUEB6xkC3T59rId+JTP06v+D7+hrnddz9uXzLkfe48P7Mi4fo8jZQY 9WJvx9BY/LW17Kd1N/Dj57BjDcA8cDIdvS3CE0QYFP05+2VhxBet77ay UP4cuLWr49rQ7FmTektpe1xN/GdV49A22K4DxQCYq2vLYaKAxTLoLmrS 3KQ=