As an operator of security‑critical DNS infrastructure, I want a native PRTG sensor that monitors DNSSEC signature status and trust chain integrity for my DNS zones, so that I can detect issues such as missing DS records, expiring signatures, or failed validation before they impact production.

Therefore, a sensor must check the following DNSSEC components:

AD flag (validation status)
Presence of RRSIG records and their signature expiration time (warn if remaining time is low!)
Count of DNSKEY records including KSK (257) and ZSK (256)
Count of DS records in the parent zone (=0 is error)
Trust chain consistency (DS -> DNSKEY -> RRSIG)