Check DNSSEC properly — including the broken-signature case a single query cannot see.
DNSSEC Validation Check on RunTheTests — free browser-based connection tools, no sign-up.