Every .dk domain whose CAA record carries pki.goog; cansignhttpexchanges=yes: for an issue/issuewild tag, the certificate authorities allowed to issue TLS certificates for the domain; for iodef, where CAs report problems. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.