decrypt all objects in a DRS record, not just the first one