What makes you think that? Like almost all sites on the Internet, I don't see DNSSEC set up for Netlify (or this content domain) at all.

You’re right, I must have totally misread that page I linked. My resolver was returning a bogus result, I toggled DNSSEC validation, and didn’t dig much further. Looks like it‘s an issue with my resolver on this domain. Odd, because I haven’t touched my configuration in ages and I haven’t seen this problem before.

oh interesting! I'm using a basic Netlify setup so I never looked into this. I'll check it out when I get a moment, thanks for flagging!

I'm running Netlify, and I also get errors on that tool on another site:

    No DS records found for [retracted].com in the com zone
    No DNSKEY records found
    [retracted].com A RR has value [retracted]
    No RRSIGs found

I wonder if all Netlify sites are "suffering". I don't really understand the problem or the % of users affected by this.

Isn't this just the DNS reporting to you that DNSSEC isn't configured for retracted.com and netlify.com at all? That's not a misconfiguration; it's the right configuration.