drill — Trace and Verify DNSSEC Chains
drill is dig's more specialised sibling, built for DNSSEC. Where a normal lookup tells you what a name resolves to, drill can walk the chain of trust from the root zone down to the record in question and show each signature it verified along the way. That trace is the only practical way to diagnose a DNSSEC failure, because the symptom — resolution simply stops working for validating resolvers — carries no information about which link in the chain broke.
Why run it
DNSSEC failures are unusually punishing. When a signature expires or a key rollover goes wrong, validating resolvers do not serve a stale answer or a warning; they refuse to answer at all. A large share of the internet abruptly cannot reach you, while anyone using a non-validating resolver sees nothing wrong, which makes the initial reports maddeningly inconsistent. Running drill turns that into a specific finding: this signature, at this level of the chain, does not verify.
Why automate it
Signatures expire on a schedule, and that schedule is the problem. A zone signed today is fine today and broken in thirty days unless resigning happens correctly every cycle, and the failure mode of an automated resigning process is silence — it stops running and nothing complains until the last valid signature lapses. Checking the chain continuously catches the gap while there is still validity left to spare, which converts a hard outage into a routine ticket. There is no manual process that reliably catches this, because the thing you need to notice is an absence.
What it gives you
Advance warning on the one DNS failure mode that takes you offline completely and gives no clue why. drill turns an opaque SERVFAIL into a named broken link, and running it on a schedule means you find the expiring signature before your visitors find the outage.