Co-authored-by: Remi Gacogne <github@coredump.fr>
There are a few cases where records will be replaced anyway:
- Record sets that are expired will always be replaced.
-- If the new record set passed DNSSEC validation it will replace an existing entry.
+- If the new record set belongs to a DNSSEC-secure zone and successfully passed validation it will replace an existing entry.
- Record sets produced by :ref:`setting-refresh-on-ttl-perc` tasks will also replace existing record sets.
.. _setting-record-cache-shards: