only alongside NXDOMAIN responses for a > signed zone – they provide authenticated denial of existence, essentially a > “signed NXDOMAIN” response. Is this considered a failure

" returns NXDOMAIN, the CA is still required to attempt looking up a CAA record for "example.com ". So I agree that your "most likely" option is the ideal

(eg NXDOMAIN), but the length of the case should be *reasonably* limited. The typical scenario to avoid is the case when the user (or resolver) queries the record (eg for debugging or