DNS: return explicit error code to caller on dnssec failure, for better logging