"DNSSEC isn't about helping you with your security issues." My understatnding of history as I experienced it is that the resurgence of interest in DNSSEC was d

"DNSSEC isn't about helping you with your security issues." My understatnding of history as I experienced it is that the resurgence of interest in DNSSEC was due to publicized cache poisoning of shared DNS caches circa 2008. I run my own local cache on the loopback. I run my own root and other zones. I also use DNSCurve. Recently there was another one of these DNSSEC advertisement posts from this same company about DNSSEC on the HN front page. (Surprise. How unusual.) I asked a simple question: What benefit would DNSSEC offer someone like me? While I did not get any straight answers, I did get blasted with walls of text from some guy working for a domain name registrar. Perhaps it is not only companies selling consulting and DNS appliances, e.g., on government contracts, that are behind DNSSEC. Maybe it extends to the entire "DNS industry", e.g., people "selling" (renting) domainnames to users. For readers who are unaware, Cloudflare is in this "DNS industry". Their customers must hand over control of their DNS to Cloudflare. Cloudflare's entire approach to "security" depends on this. DNSSEC is generally a PITA to set up and maintain. This makes it the perfect "service" to sell. If you like to generalize, you could argue this is true for any sufficiently complex networking component. The more complex the set up and management for users, the easier it is to sell them services. I am an ordinary user who happens to enjoy setting up and managing my own DNS, making databases of IP addresses and even making my own domainnames, so I need a lot of convincing to be interested in something like DNSSEC, managed by third parties. DNSSEC, as advertised, is a system that focuses on some mythical "validation" of DNS data. Who decides what DNS data is "valid"? Does DNSSEC require a "web of trust" model like the CA system? If yes, why should we trust these third parties more than the endpoint we're trying to reach? How much will users have to pay to be "validated" in such a system? If some third party(s) controls what is and what is not "valid" DNS data can they more easily "disable" certain domains? I could go on. By contrast, a system for encrypting DNS packets is something I find more interesting and useful. I can set it up without too much effort and I control it. No need for third parties. Once more, it costs me nothing. There is no built-in idea of "web of trust" and I do not need to "purchase" a "valid" dommainname to begin using it. But I am just a dumb user so what do I know? Go get your DNSSEC, right away.