isc.org
BIND 9 Security Release and Multi-Vendor Vulnerability Handling
Essentially, the attacker crafts a DNS zone with many DNSKEY and RRSIG records, and a standards-compliant DNSSEC validator tries all possible combinations of DNSKEY and RRSIG records in the vain hope of finding the one combination which matches and validates. If the validator does not implement an explicit limit on the amount of work it will do, it can spend an outrageous amount of resources doing useless work.