Nothing at all under .MIL, if you use a validating resolver. % dig A www.afnic.af.mil ; <<>> DiG 9.8.1-P1 <<>> A www.afnic.af.mil ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 10424 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.afnic.af.mil. IN A ;; Query time: 16 msec ;; SERVER: ::1#53(::1) ;; WHEN: Thu Dec 27 10:06:01 2012 ;; MSG SIZE rcvd: 45 This is because the signature expired yesterday (the week between Xmas and the New Year is difficult...) Nice pictures at <http://dnsviz.net/d/mil/dnssec/>