SERVFAIL is frustrating because it names a result, not an owner. The fastest useful split is a paired query against the same validating resolver: if the normal query fails but the same query succeeds with +cd, DNS data exists and DNSSEC validation is the differentiator. That does ...