The use-case for DNSSEC is still far from clear to me. DANE is the closest thing to a valid use case and it looks like Chrome and others are exploring better so

The use-case for DNSSEC is still far from clear to me. DANE is the closest thing to a valid use case and it looks like Chrome and others are exploring better solutions than DANE. Moreover -- The lack of encryption is still a major issue IMHO. Validation is great, except that when a record fails to validate the end user experience is essentially NXDOMAIN which is not a very friendly user experience. At least with SSL certificate failures, the application has visibility into the cause of the failure. In DNSSEC, it's hard to distinguish between a failed validation and any other kind of DNS resolution failure. I just can't see a world where people enable validating resolvers that reject non-validating responses. And if that's true, then the entire point of DNSSEC is largely compromised -- with the possible exception of using DNSSEC to validate in-line verifications (a la DANE).