no SEP matching is a dnssec error. The DS key in the .com. zone file are there but no longer available in herokudns.com.

Hopefully someone has a backup of those keys. If not, I think they have to contact .com. to replace the keys. It can take several hours to come back.