RRSIG NSEC3 proving non-existence of gandi.net/DS alg 8, id 15314: With a TTL of 86400 the RRSIG RR can be in the cache of a non-validating resolver until 10 hours, 35 minutes after it expires at 2020-10-24 07:02:31+00:00. See RFC 4035, Sec. 5.3.3.
gandi.net/DS has errors; select the "Denial of existence" DNSSEC option to see them.