validate DNSSEC