Every .dk domain whose CAA record carries digicert.com; account=b34fd286db03ccad020f0a75010dd75544eaf2b967195b4becb6460c924d35c9: for an issue/issuewild tag, the certificate authorities allowed to issue TLS certificates for the domain; for iodef, where CAs report problems. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.