DNS security is important but DNSSEC may be a failed experiment

The post examines why DNSSEC adoption lags despite decades of availability, contrasting its limited user-visible benefits and dependency on end-to-end hierarchical deployment with HTTPS’s widespread success, and noting infrastructure trends like ROV/ASPA in routing security. It validates DNSSEC for a specific domain using DNSviz and Verisign tools, highlights censorship risks affecting DNS, and explains how DoH/DoT (and Oblivious DNS) complement but do not replace DNSSEC’s data integrity guarantees. The author concludes that while DNS remains critical, DNSSEC may remain under-deployed, warranting continued efforts to improve DNS security through complementary measures.