DNS problem: looking up A for xxx.domain.top: DNSSEC: DNSKEY Missing; no valid AAAA records found for xxx.domain.top

[Nummer378]

Quoting a Let's Encrypt enginner here:

@mcpherrinm

We are still investigating. The problem does appear to be with the .top nameservers, and we are attempting to contact the .top operators for more information.

@mcpherrinm

This problem is ongoing, and appears to potentially be the .top TLD blocking validation traffic from Let's Encrypt.

@mcpherrinm

We are trying to get in contact with the .top operators for assistance in getting their name servers to respond to our DNS queries.

This doesn't sound like discussing about DNSSEC here is going to help anyone. Based on my understanding of the situtation, the DNSSEC is fine for the top TLD. The issue appears to be that Let's Encrypts resolvers are blocked by top nameservers, only receiving a bogus response. The DNSSEC query just happens to be (one of) the first queries unbound hits the top nameserver with. Hence the DNSSEC failure is likely to be a symptom of the problem, not the cause. This also explains why every other resolver has zero issues with the DNSSEC for the top TLD.