> Right now there are no benefits though. In terms of privacy, I would mostly agree. Using an authenticated channel to your resolver still protects against man

> Right now there are no benefits though. In terms of privacy, I would mostly agree. Using an authenticated channel to your resolver still protects against many common MitM vectors, so there's definitely a benefit there. Unlike DNSSEC, you're not dependent on the target domain being in the small subset of DNSSEC-enabled domains, not to mention that most client resolvers won't validate DNSSEC anyway.