Figure 4

Figure 4: On Windows, you can use nslookup and a test address to check whether DNSSEC is in use. If not, the request for sigfail.verteiltesysteme.net returns an IP address, because the faulty signature is not checked.