# DNSSEC validation failure logging

This module logs a message for each DNSSEC validation failure (on `notice` `level`). It is meant to provide hint to operators which queries should be investigated using diagnostic tools like DNSViz.

Add following line to your configuration file to enable it:

    modules.load('bogus_log')

Example of error message logged by this module:

    [dnssec] validation failure: dnssec-failed.org. DNSKEY

List of most frequent queries which fail as DNSSEC bogus can be obtained at run-time:

    > bogus_log.frequent()
    {
        {
            ['count'] = 1,
            ['name'] = 'dnssec-failed.org.',
            ['type'] = 'DNSKEY',
        },
        {
            ['count'] = 13,
            ['name'] = 'rhybar.cz.',
            ['type'] = 'DNSKEY',
        },
    }

Please note that in future this module might be replaced with some other way to log this information.