Technical tl;dr:

The DS record was cached for 24 hours but the DNSKEY record was cached for 1 hour. The DS and DNSKEY records were rotated due to an annual rotation of the signing key. The (cached) old DS record referenced the old DNSKEY. This inconsistency invalidated records for resolvers which validated dnssec records (85% of New Zealanders users, mostly through their ISPs’ resolvers.)

Procedural tl;dr: Management was not informed of the incident until the next day. DNS operators were not made aware of the rotation of the KSK (key signing key) so the problem by outside operators was difficult to theorise.