its gonna be all .de domains once caches dry out, anything that still works right now is bound to eventually fail until the underlying issue is resolved

Any .de domain with DNSSEC

Unfortunately, even domains that did not have DNSSEC enabled earlier today are affected.

We observed issues on a non-DNSSEC .de domain at 19:45Z and confirmed around 20:12Z it wasn't just us, but also more high profile domain names.

Any .de domain is affected, regardless of the domain's dnssec deployment status, as long as you use a resolver which validates dnssec.