pay.gov/A: DNSSEC was effectively downgraded because the response had an invalid RCODE (SERVFAIL) with EDNS enabled. See RFC 6891, Sec. 7, RFC 2671, Sec. 5.3. (156.154.66.108, UDP_-_NOEDNS_)
pay.gov/A: The DNSSEC records necessary to validate the response could not be retrieved from the server. See RFC 4035, Sec. 3.1.1, RFC 4035, Sec. 3.1.3. (156.154.66.108, UDP_-_EDNS0_4096_D_KN)
pay.gov/A: The response had an invalid RCODE (SERVFAIL) until EDNS was disabled (however, this server appeared to respond legitimately to other queries with EDNS enabled). See RFC 6891, Sec. 6.2.6. (156.154.66.108, UDP_-_EDNS0_4096_D_KN)
pay.gov/A: The response had an invalid RCODE (SERVFAIL). See RFC 1035, Sec. 4.1.1. (156.154.64.108, 156.154.65.108, 156.154.67.108, 2001:502:4612::90, 2001:502:f3ff::90, 2610:a1:1014::90, UDP_-_NOEDNS_)
pay.gov/AAAA: The response had an invalid RCODE (SERVFAIL). See RFC 1035, Sec. 4.1.1. (156.154.64.108, 156.154.65.108, 156.154.66.108, 156.154.67.108, 2001:502:4612::90, 2001:502:f3ff::90, 2610:a1:1014::90, 2610:a1:1015::90, UDP_-_NOEDNS_)