.dk domains whose latest scan fail DNSSEC validation, so validating resolvers refuse them. Nearly all are dead delegations: the parent still publishes a DS record but the nameservers don't answer, so no signed answer can be fetched (marked below); the rest serve broken signatures. See the full breakdown on the
statistics page.
DNSSEC signs DNS answers so resolvers can detect forgery. This list shows the .dk domains with a given validation result on their latest scan. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.