You're correct. DNS-over-TLS secures you<-->resolver; DNSSEC secures validating-resolver<-->authority, essentially. If your resolver is validating, then it sec

You're correct. DNS-over-TLS secures you<-->resolver; DNSSEC secures validating-resolver<-->authority, essentially. If your resolver is validating, then it secures you<-->authority. Point being DNSSEC can be used to secure more hops than DNS-over-TLS, but DNS-over-TLS can secure the last hop without any opt-in by the domain owner.