Why "the records exist" isn't the same as "the chain is valid"

A domain can have DNSKEY, DS, and RRSIG records published and still be DNSSEC-broken — a stale RRSIG whose signature has expired, a DS record left over at the parent after a key rollover that doesn't match any current DNSKEY, a signature that simply doesn't cryptographically verify against the key it claims to be signed by. Any tool that only checks "are these record types present" would report all of these broken configurations as fine, since the records genuinely are there — they're just wrong. This tool instead performs the actual cryptographic operations a validating resolver performs: recomputing the DS digest from the DNSKEY and comparing it, and verifying the RRSIG signature against the key material, which is the only way to catch the misconfigurations that matter in practice.

Why the standard Node.js DNS API couldn't be used here

Node's built-in DNS resolution is designed for applications that just want an answer — an IP address, an MX record — and doesn't expose the raw DNSKEY, DS, and RRSIG record types or the signature data needed to actually validate anything. Performing real DNSSEC validation meant writing a raw DNS wire-protocol client from scratch on the server side specifically to request and parse these record types directly, then implementing the actual signature verification (RSA/SHA-256 and ECDSA P-256/P-384) against the parsed key material — there was no shortcut through a higher-level library that already did this.

What "island of security" means, in plain terms

A zone can be perfectly self-consistent — its DNSKEY and RRSIG records check out internally — while still having no DS record published at its parent zone, which is the record that actually links it into the global chain of trust rooted at the DNS root zone. Without that parent-level link, a validating resolver has no way to know the zone's DNSKEY should be trusted at all, so it simply treats the zone as unsigned rather than validated — the zone's internal correctness buys it nothing from the outside. This is a surprisingly common state right after DNSSEC is first enabled on a zone, before the DS record has been submitted to and published by the registrar.